Edit tour

Windows Analysis Report
T.T_Copy.12.18.2024.exe

Overview

General Information

Sample name:	T.T_Copy.12.18.2024.exe
Analysis ID:	1578101
MD5:	4542c9e57e9d955244262c035aaffe94
SHA1:	3dfade02ec7892ebdfa977c25354a352e0c55f56
SHA256:	98c70efff4675dd2ef3f9a90afb155c4fdbee2aa1f0f2e1641f9c0b8f432407a
Tags:	exeuser-lowmal3
Infos:

Detection

ArrowRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected ArrowRAT

Yara detected Powershell download and execute

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Sigma detected: Explorer NOUACCHECK Flag

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

File is packed with WinRar

Found evasive API chain (date check)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion NT Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

T.T_Copy.12.18.2024.exe (PID: 1296 cmdline: "C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe" MD5: 4542C9E57E9D955244262C035AAFFE94)

cmd.exe (PID: 2828 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\oxfhxtr.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dfbzdfb.sfx.exe (PID: 5428 cmdline: dfbzdfb.sfx.exe -dC:\Users\user\AppData\Local\Temp -pepouidalfszfugyRhvqxsdfHbgnmeUtyadfhmxvfofnglfyjfodyehal MD5: 3181C79BFCB07A0B43A020F22641F2B2)

dfbzdfb.exe (PID: 6260 cmdline: "C:\Users\user\AppData\Local\Temp\dfbzdfb.exe" MD5: 06EB0777FCA570612C196D90F0499213)

cmd.exe (PID: 4640 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\zdsthsxu.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 60 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

zdfhrgzd.sfx.exe (PID: 4788 cmdline: zdfhrgzd.sfx.exe -dC:\Users\user\AppData\Roaming -pesgujhbotoqxqegtpsadelifsujhmwxgthutjkdewsqwngjMiczafugybsbBbsdhdqbqeku MD5: F59872E2FCC71EF9EB742E3792C37A76)

zdfhrgzd.exe (PID: 7264 cmdline: "C:\Users\user\AppData\Roaming\zdfhrgzd.exe" MD5: EC0967A3E53D490E8E1CE811CE53D003)

zdfhrgzd.exe (PID: 7396 cmdline: C:\Users\user\AppData\Roaming\zdfhrgzd.exe MD5: EC0967A3E53D490E8E1CE811CE53D003)

explorer.exe (PID: 7480 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

cvtres.exe (PID: 7508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

zdfhrgzd.exe (PID: 7460 cmdline: C:\Users\user\AppData\Roaming\zdfhrgzd.exe MD5: EC0967A3E53D490E8E1CE811CE53D003)

explorer.exe (PID: 7604 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

cvtres.exe (PID: 7644 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 1892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\mts103wift.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3700 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2008 --field-trial-handle=1568,i,4831233176812548805,4032145808458294769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

explorer.exe (PID: 7664 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 7808 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
ArrowRAT	It is available as a service, purchasable by anyone to use in their own campaigns. Its features are generally fairly typical of a RAT, with its most notable aspect being the hVNC module which basically gives an attacker full remote access with minimal need for technical knowledge to use it.	No Attribution	https://www.arrowrat.com	https://malpedia.caad.fkie.fraunhofer.de/details/win.arrowrat

Malware Configuration

Threatname: ArrowRAT

{"C2 url": "127.0.0.1", "Port": "1338", "Identifier": "Client01", "Mutex": "OSHPAW"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: zdfhrgzd.exe PID: 7396	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: zdfhrgzd.exe PID: 7396	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: zdfhrgzd.exe PID: 7460	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: zdfhrgzd.exe PID: 7460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cvtres.exe PID: 7508	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: cvtres.exe PID: 7508	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cvtres.exe PID: 7644	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: cvtres.exe PID: 7644	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.cvtres.exe.400000.0.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
15.2.zdfhrgzd.exe.2bd13c0.0.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
17.2.cvtres.exe.400000.0.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
14.2.zdfhrgzd.exe.2d02d00.1.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\explorer.exe /NoUACCheck, CommandLine: C:\Windows\explorer.exe /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\explorer.exe /NoUACCheck, ProcessId: 7664, ProcessName: explorer.exe

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\zdfhrgzd.exe, ProcessId: 7396, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack

Malware Configuration Extractor: ArrowRAT {"C2 url": "127.0.0.1", "Port": "1338", "Identifier": "Client01", "Mutex": "OSHPAW"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe

ReversingLabs: Detection: 18%

Multi AV Scanner detection for submitted file

Source: T.T_Copy.12.18.2024.exe	ReversingLabs: Detection: 34%
Source: T.T_Copy.12.18.2024.exe	Virustotal: Detection: 42%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe	Joe Sandbox ML: detected

Source: T.T_Copy.12.18.2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: T.T_Copy.12.18.2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: T.T_Copy.12.18.2024.exe, dfbzdfb.sfx.exe.1.dr, zdfhrgzd.sfx.exe.5.dr, dfbzdfb.exe.4.dr
Source:	Binary string: D:\Work\C#\Pandora_Development\Production\1.8\DLL\obj\Release\DLL.pdb source: zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022A2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_0022A2C3
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023A536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_0023A536
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00247D69 FindFirstFileExA,	1_2_00247D69
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDA2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_00BDA2C3
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEA536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_00BEA536
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BF7D69 FindFirstFileExA,	4_2_00BF7D69
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068A2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	5_2_0068A2C3
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006A7D69 FindFirstFileExA,	5_2_006A7D69
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069A536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	5_2_0069A536
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096A2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_0096A2C3
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097A536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_0097A536
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00987D69 FindFirstFileExA,	9_2_00987D69

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 127.0.0.1

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.254.27.112:1337/skra.jpg
Source: 77EC63BDA74BD0D0E0426DC8F80085060.10.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: cvtres.exe, 00000014.00000002.2678720038.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2D85F72862B55C4EADD9E66E06947F3D0.10.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe

Code function: 14_2_013126C4 CreateDesktopW,

14_2_013126C4

System Summary

.NET source code contains very large strings

Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, HVNC.cs

Long String: Length: 59992

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_00227070: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

1_2_00227070

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00235983	1_2_00235983
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_002283EB	1_2_002283EB
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022E097	1_2_0022E097
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_002330E5	1_2_002330E5
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023E8EC	1_2_0023E8EC
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0024E8D4	1_2_0024E8D4
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_002231F0	1_2_002231F0
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022D222	1_2_0022D222
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023F200	1_2_0023F200
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022BA6A	1_2_0022BA6A
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023FA6A	1_2_0023FA6A
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00232B39	1_2_00232B39
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00242B68	1_2_00242B68
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0024A350	1_2_0024A350
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_002363F1	1_2_002363F1
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022DC32	1_2_0022DC32
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022ECE9	1_2_0022ECE9
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00232DB4	1_2_00232DB4
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00235DB8	1_2_00235DB8
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023EDE8	1_2_0023EDE8
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022D634	1_2_0022D634
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023F635	1_2_0023F635
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00249EA0	1_2_00249EA0
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00225E83	1_2_00225E83
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00222759	1_2_00222759
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00234FB4	1_2_00234FB4
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00223F95	1_2_00223F95
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE5983	4_2_00BE5983
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BD83EB	4_2_00BD83EB
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDE097	4_2_00BDE097
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEE8EC	4_2_00BEE8EC
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE30E5	4_2_00BE30E5
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BFE8D4	4_2_00BFE8D4
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BD31F0	4_2_00BD31F0
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDD222	4_2_00BDD222
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEF200	4_2_00BEF200
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEFA6A	4_2_00BEFA6A
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDBA6A	4_2_00BDBA6A
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE63F1	4_2_00BE63F1
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE2B39	4_2_00BE2B39
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BF2B68	4_2_00BF2B68
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BFA350	4_2_00BFA350
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDECE9	4_2_00BDECE9
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDDC32	4_2_00BDDC32
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE5DB8	4_2_00BE5DB8
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE2DB4	4_2_00BE2DB4
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEEDE8	4_2_00BEEDE8
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BF9EA0	4_2_00BF9EA0
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BD5E83	4_2_00BD5E83
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDD634	4_2_00BDD634
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEF635	4_2_00BEF635
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BE4FB4	4_2_00BE4FB4
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BD3F95	4_2_00BD3F95
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BD2759	4_2_00BD2759
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00695983	5_2_00695983
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006883EB	5_2_006883EB
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069E8EC	5_2_0069E8EC
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006930E5	5_2_006930E5
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006AE8D4	5_2_006AE8D4
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068E097	5_2_0068E097
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006831F0	5_2_006831F0
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068BA6A	5_2_0068BA6A
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069FA6A	5_2_0069FA6A
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068D222	5_2_0068D222
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069F200	5_2_0069F200
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006A2B68	5_2_006A2B68
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006AA350	5_2_006AA350
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00692B39	5_2_00692B39
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006963F1	5_2_006963F1
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068DC32	5_2_0068DC32
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068ECE9	5_2_0068ECE9
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069EDE8	5_2_0069EDE8
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00695DB8	5_2_00695DB8
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00692DB4	5_2_00692DB4
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068D634	5_2_0068D634
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069F635	5_2_0069F635
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006A9EA0	5_2_006A9EA0
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00685E83	5_2_00685E83
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00682759	5_2_00682759
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00694FB4	5_2_00694FB4
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_00683F95	5_2_00683F95
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00975983	9_2_00975983
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_009683EB	9_2_009683EB
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096E097	9_2_0096E097
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0098E8D4	9_2_0098E8D4
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_009730E5	9_2_009730E5
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097E8EC	9_2_0097E8EC
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_009631F0	9_2_009631F0
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097F200	9_2_0097F200
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096D222	9_2_0096D222
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096BA6A	9_2_0096BA6A
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097FA6A	9_2_0097FA6A
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_009763F1	9_2_009763F1
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00972B39	9_2_00972B39
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0098A350	9_2_0098A350
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00982B68	9_2_00982B68
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096ECE9	9_2_0096ECE9
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096DC32	9_2_0096DC32
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00972DB4	9_2_00972DB4
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00975DB8	9_2_00975DB8
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097EDE8	9_2_0097EDE8
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00965E83	9_2_00965E83
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00989EA0	9_2_00989EA0
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096D634	9_2_0096D634
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097F635	9_2_0097F635
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00963F95	9_2_00963F95
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00974FB4	9_2_00974FB4
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00962759	9_2_00962759
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03244348	13_2_03244348
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03240A40	13_2_03240A40
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_032419C0	13_2_032419C0
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03241618	13_2_03241618
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03243D78	13_2_03243D78
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03241DEB	13_2_03241DEB
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03244338	13_2_03244338
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03240A33	13_2_03240A33
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_032419B0	13_2_032419B0
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03241608	13_2_03241608
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03243D69	13_2_03243D69
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 14_2_01312F40	14_2_01312F40
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 15_2_010A2F40	15_2_010A2F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 20_2_0134CBB8	20_2_0134CBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 20_2_0134CF80	20_2_0134CF80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 20_2_0134DDA0	20_2_0134DDA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 20_2_0134C780	20_2_0134C780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 20_2_0134CF70	20_2_0134CF70

Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: String function: 0069D810 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: String function: 0069CEC0 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: String function: 0069CDF0 appears 37 times
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: String function: 0023CDF0 appears 37 times
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: String function: 0023CEC0 appears 53 times
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: String function: 0023D810 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: String function: 00BECEC0 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: String function: 00BECDF0 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: String function: 00BED810 appears 31 times
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: String function: 0097CDF0 appears 37 times
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: String function: 0097D810 appears 31 times
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: String function: 0097CEC0 appears 53 times

Source: T.T_Copy.12.18.2024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: zdfhrgzd.exe.9.dr, Module2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: I4R41F.exe.14.dr, Module2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, PandoraRecovery.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, PandoraRecovery.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 14.2.zdfhrgzd.exe.3d2f548.2.raw.unpack, Module2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, PandoraRecovery.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, PandoraRecovery.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 15.2.zdfhrgzd.exe.3bb0468.1.raw.unpack, Module2.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, Installer.cs

Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'

Source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@48/44@1/1

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_00238BCF FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

1_2_00238BCF

Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe

File created: C:\Users\user\AppData\Roaming\__tmp_rar_sfx_access_check_4163625

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: \Sessions\1\BaseNamedObjects\OSHPAW
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:60:120:WilError_03

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4160750

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\zdsthsxu.bat" "

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Command line argument: *x'	1_2_0023C130
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Command line argument: *a&	1_2_0023C130
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Command line argument: 8y'	1_2_0023C130
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Command line argument: sfxname	1_2_0023C130
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Command line argument: sfxstime	1_2_0023C130
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Command line argument: STARTDLG	1_2_0023C130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Command line argument: sfxname	4_2_00BEC130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Command line argument: sfxstime	4_2_00BEC130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Command line argument: STARTDLG	4_2_00BEC130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Command line argument: *xm	5_2_0069C130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Command line argument: *al	5_2_0069C130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Command line argument: 8ym	5_2_0069C130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Command line argument: sfxname	5_2_0069C130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Command line argument: sfxstime	5_2_0069C130
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Command line argument: STARTDLG	5_2_0069C130
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Command line argument: sfxname	9_2_0097C130
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Command line argument: sfxstime	9_2_0097C130
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Command line argument: STARTDLG	9_2_0097C130

Source: T.T_Copy.12.18.2024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cvtres.exe, 00000014.00000002.2677778081.000000000116C000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2678720038.0000000002DB3000.00000004.00000800.00020000.00000000.sdmp, TMP_pass.20.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: T.T_Copy.12.18.2024.exe	ReversingLabs: Detection: 34%
Source: T.T_Copy.12.18.2024.exe	Virustotal: Detection: 42%

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

File read: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe "C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe"
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\oxfhxtr.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe dfbzdfb.sfx.exe -dC:\Users\user\AppData\Local\Temp -pepouidalfszfugyRhvqxsdfHbgnmeUtyadfhmxvfofnglfyjfodyehal
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Process created: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe "C:\Users\user\AppData\Local\Temp\dfbzdfb.exe"
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\zdsthsxu.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\mts103wift.pdf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe zdfhrgzd.sfx.exe -dC:\Users\user\AppData\Roaming -pesgujhbotoqxqegtpsadelifsujhmwxgthutjkdewsqwngjMiczafugybsbBbsdhdqbqeku
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2008 --field-trial-handle=1568,i,4831233176812548805,4032145808458294769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe "C:\Users\user\AppData\Roaming\zdfhrgzd.exe"
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\oxfhxtr.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe dfbzdfb.sfx.exe -dC:\Users\user\AppData\Local\Temp -pepouidalfszfugyRhvqxsdfHbgnmeUtyadfhmxvfofnglfyjfodyehal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Process created: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe "C:\Users\user\AppData\Local\Temp\dfbzdfb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\zdsthsxu.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\mts103wift.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe zdfhrgzd.sfx.exe -dC:\Users\user\AppData\Roaming -pesgujhbotoqxqegtpsadelifsujhmwxgthutjkdewsqwngjMiczafugybsbBbsdhdqbqeku	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe "C:\Users\user\AppData\Roaming\zdfhrgzd.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2008 --field-trial-handle=1568,i,4831233176812548805,4032145808458294769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mscoree.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: dpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\explorer.exe	Section loaded: icu.dll
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\explorer.exe	Section loaded: slc.dll
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\explorer.exe	Section loaded: icu.dll
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: T.T_Copy.12.18.2024.exe

Static file information: File size 1208662 > 1048576

Source: T.T_Copy.12.18.2024.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: T.T_Copy.12.18.2024.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: T.T_Copy.12.18.2024.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: T.T_Copy.12.18.2024.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: T.T_Copy.12.18.2024.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: T.T_Copy.12.18.2024.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: T.T_Copy.12.18.2024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: T.T_Copy.12.18.2024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: T.T_Copy.12.18.2024.exe, dfbzdfb.sfx.exe.1.dr, zdfhrgzd.sfx.exe.5.dr, dfbzdfb.exe.4.dr
Source:	Binary string: D:\Work\C#\Pandora_Development\Production\1.8\DLL\obj\Release\DLL.pdb source: zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: T.T_Copy.12.18.2024.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: T.T_Copy.12.18.2024.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: T.T_Copy.12.18.2024.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: T.T_Copy.12.18.2024.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: T.T_Copy.12.18.2024.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, PandoraRecovery.cs	.Net Code: OnResolveAssembly System.Reflection.Assembly.Load(byte[])
Source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, PandoraRecovery.cs	.Net Code: OnResolveAssembly System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4160750

Jump to behavior

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023D856 push ecx; ret	1_2_0023D869
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023CDF0 push eax; ret	1_2_0023CE0E
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BED856 push ecx; ret	4_2_00BED869
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BECDF0 push eax; ret	4_2_00BECE0E
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069D856 push ecx; ret	5_2_0069D869
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069CDF0 push eax; ret	5_2_0069CE0E
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097D856 push ecx; ret	9_2_0097D869
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097CDF0 push eax; ret	9_2_0097CE0E
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03240145 push edx; retf	13_2_032400E2
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Code function: 13_2_03249540 pushad ; iretd	13_2_03249541

Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	File created: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	File created: C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	File created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	File created: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	File created: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 1880000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 3360000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 3180000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 1310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 4C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 10A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 2B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: 4B10000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 1340000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 2D80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_5-22129
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_1-22070

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe TID: 7300	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe TID: 7568	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7648	Thread sleep count: 36 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7648	Thread sleep time: -36000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0022A2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_0022A2C3
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023A536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_0023A536
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00247D69 FindFirstFileExA,	1_2_00247D69
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BDA2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_00BDA2C3
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEA536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_00BEA536
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BF7D69 FindFirstFileExA,	4_2_00BF7D69
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0068A2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	5_2_0068A2C3
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006A7D69 FindFirstFileExA,	5_2_006A7D69
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069A536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	5_2_0069A536
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0096A2C3 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_0096A2C3
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097A536 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_0097A536
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00987D69 FindFirstFileExA,	9_2_00987D69

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_0023C8D4 VirtualQuery,GetSystemInfo,

1_2_0023C8D4

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Thread delayed: delay time: 922337203685477

Source: dfbzdfb.sfx.exe, 00000004.00000002.1461867137.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: zdfhrgzd.sfx.exe, 00000009.00000002.1543319249.000000000077F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: dfbzdfb.sfx.exe, 00000004.00000002.1461867137.0000000000E3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: zdfhrgzd.sfx.exe, 00000009.00000002.1543319249.000000000077F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y@
Source: cvtres.exe, 00000014.00000002.2677778081.0000000001108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	API call chain: ExitProcess graph end node	graph_1-22411
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	API call chain: ExitProcess graph end node	graph_4-22570
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	API call chain: ExitProcess graph end node	graph_5-22517
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	API call chain: ExitProcess graph end node	graph_9-23650

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe

Code function: 14_2_01316118 LdrInitializeThunk,

14_2_01316118

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_0023DA15 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0023DA15

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_002449FA mov eax, dword ptr fs:[00000030h]	1_2_002449FA
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BF49FA mov eax, dword ptr fs:[00000030h]	4_2_00BF49FA
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006A49FA mov eax, dword ptr fs:[00000030h]	5_2_006A49FA
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_009849FA mov eax, dword ptr fs:[00000030h]	9_2_009849FA

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_00248A9B GetProcessHeap,

1_2_00248A9B

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023DA15 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0023DA15
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023DB63 SetUnhandledExceptionFilter,	1_2_0023DB63
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_00245B43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00245B43
Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: 1_2_0023DD1B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0023DD1B
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEDA15 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00BEDA15
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEDB63 SetUnhandledExceptionFilter,	4_2_00BEDB63
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BF5B43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00BF5B43
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: 4_2_00BEDD1B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00BEDD1B
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069DA15 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0069DA15
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069DB63 SetUnhandledExceptionFilter,	5_2_0069DB63
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_006A5B43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_006A5B43
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: 5_2_0069DD1B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0069DD1B
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097DA15 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_0097DA15
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_00985B43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00985B43
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097DB63 SetUnhandledExceptionFilter,	9_2_0097DB63
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: 9_2_0097DD1B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0097DD1B

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: zdfhrgzd.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zdfhrgzd.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7644, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi)))
Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: VirtualAllocEx(processInformation.ProcessHandle, num2, length, 12288, 64)
Source: 13.2.zdfhrgzd.exe.441e068.0.raw.unpack, RunPE.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num4, data, bufferSize, ref bytesRead)

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 412000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 414000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: EC0008
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 412000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 414000
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: BF2008

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\oxfhxtr.cmd" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe dfbzdfb.sfx.exe -dC:\Users\user\AppData\Local\Temp -pepouidalfszfugyRhvqxsdfHbgnmeUtyadfhmxvfofnglfyjfodyehal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Process created: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe "C:\Users\user\AppData\Local\Temp\dfbzdfb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\zdsthsxu.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\mts103wift.pdf"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe zdfhrgzd.sfx.exe -dC:\Users\user\AppData\Roaming -pesgujhbotoqxqegtpsadelifsujhmwxgthutjkdewsqwngjMiczafugybsbBbsdhdqbqeku	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe "C:\Users\user\AppData\Roaming\zdfhrgzd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Users\user\AppData\Roaming\zdfhrgzd.exe C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW

Source: zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_0023D86B cpuid

1_2_0023D86B

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	1_2_0023932E
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	4_2_00BE932E
Source: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	5_2_0069932E
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	9_2_0097932E

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Users\user\AppData\Roaming\zdfhrgzd.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Users\user\AppData\Roaming\zdfhrgzd.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Users\user\AppData\Roaming\zdfhrgzd.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_0023C130 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,

1_2_0023C130

Source: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe

Code function: 1_2_0022A930 GetVersionExW,

1_2_0022A930

Source: C:\Users\user\AppData\Roaming\zdfhrgzd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: cvtres.exe, 00000014.00000002.2677778081.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: cvtres.exe, 00000014.00000002.2677778081.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677778081.000000000116C000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677778081.0000000001108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected ArrowRAT

Source: Yara match	File source: 20.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.zdfhrgzd.exe.2bd13c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.zdfhrgzd.exe.2d02d00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zdfhrgzd.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zdfhrgzd.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7644, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality

Yara detected ArrowRAT

Source: Yara match	File source: 20.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.zdfhrgzd.exe.2bd13c0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.zdfhrgzd.exe.2bd13c0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.zdfhrgzd.exe.2d02d00.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.zdfhrgzd.exe.2d02d00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zdfhrgzd.exe PID: 7396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zdfhrgzd.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7644, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	312 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Create Account	1 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	Login Hook	11 Software Packing	NTDS	141 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	312 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
T.T_Copy.12.18.2024.exe	34%	ReversingLabs	Win32.Trojan.Uztuby
T.T_Copy.12.18.2024.exe	42%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\zdfhrgzd.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\zdfhrgzd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe	18%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://51.254.27.112:1337/skra.jpg	0%	Avira URL Cloud	safe
127.0.0.1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
127.0.0.1	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1	zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://51.254.27.112:1337/skra.jpg	zdfhrgzd.exe, 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, zdfhrgzd.exe, 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, cvtres.exe, 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.10.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	cvtres.exe, 00000014.00000002.2678720038.0000000002D81000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578101
Start date and time:	2024-12-19 08:59:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	T.T_Copy.12.18.2024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@48/44@1/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 290 Number of non-executed functions: 193
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 172.64.41.3, 162.159.61.3, 23.195.61.56, 199.232.214.172, 2.20.40.170, 2.19.126.149, 2.19.126.143, 54.224.241.105, 92.122.16.236, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target cvtres.exe, PID 7644 because it is empty
Execution Graph export aborted for target zdfhrgzd.exe, PID 7264 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:00:42	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
03:02:15	API Interceptor	5x Sleep call for process: cvtres.exe modified
09:00:35	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Sh2uIqqKqc.exe	Get hash	malicious	Cryptbot	Browse	199.232.214.172
	alyemenione.lnk	Get hash	malicious	Havoc, Quasar	Browse	199.232.214.172
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	PyIsvSahWy.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	PkContent.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	Order_948575494759.xls	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.164275214551747
Encrypted:	false
SSDEEP:	6:78V4yq2PCHhJ2nKuAl9OmbnIFUt8O8Vcjz1Zmw+O8VQNSpRkwOCHhJ2nKuAl9Omt:7NyvBHAahFUt8O3jZ/+ORApR56HAaSJ
MD5:	41440DD3C3DE851486BE8A26E1AFD1BC
SHA1:	84A3A5ED365B8D8975235B8E1C8DE4C32C9D8726
SHA-256:	2DFF9B49C9502B2526435D7993888A0C16210252748DEB70DCBB285E725D5E63
SHA-512:	DBEB27B7CB35C06121FFB366891FAD661FA2B1BE287C4AA4B44481A7D94805DF702B208626A2BEE886806504E0301078C315597AD0C2E5ED1549A7E33DAFAF93
Malicious:	false
Preview:	2024/12/19-03:00:30.407 1174 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/19-03:00:30.414 1174 Recovering log #3.2024/12/19-03:00:30.415 1174 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.164275214551747
Encrypted:	false
SSDEEP:	6:78V4yq2PCHhJ2nKuAl9OmbnIFUt8O8Vcjz1Zmw+O8VQNSpRkwOCHhJ2nKuAl9Omt:7NyvBHAahFUt8O3jZ/+ORApR56HAaSJ
MD5:	41440DD3C3DE851486BE8A26E1AFD1BC
SHA1:	84A3A5ED365B8D8975235B8E1C8DE4C32C9D8726
SHA-256:	2DFF9B49C9502B2526435D7993888A0C16210252748DEB70DCBB285E725D5E63
SHA-512:	DBEB27B7CB35C06121FFB366891FAD661FA2B1BE287C4AA4B44481A7D94805DF702B208626A2BEE886806504E0301078C315597AD0C2E5ED1549A7E33DAFAF93
Malicious:	false
Preview:	2024/12/19-03:00:30.407 1174 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/19-03:00:30.414 1174 Recovering log #3.2024/12/19-03:00:30.415 1174 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.119457696138752
Encrypted:	false
SSDEEP:	6:78V2Kq2PCHhJ2nKuAl9Ombzo2jMGIFUt8O8VtXZmw+O8VtFkwOCHhJ2nKuAl9OmT:7xKvBHAa8uFUt8OKX/+OKF56HAa8RJ
MD5:	81DBF5DF6F9312DF55400183B0F64AF5
SHA1:	BA72B87DF944EE246BA1DE239A540CBEBEEE8AA0
SHA-256:	E0BC263CB82C0500491C09F3976C4AADCB1CAA7C6279778E8E27BD525FDF9980
SHA-512:	C415C89728B3985F0B6996B0003A4EA2B526374354B0DA8333945D2ED4FC436953897E4B65CC03A1F3F5509E1495912633B51200A68F5604ABFE93D7069F1E37
Malicious:	false
Preview:	2024/12/19-03:00:30.629 ad0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/19-03:00:30.631 ad0 Recovering log #3.2024/12/19-03:00:30.631 ad0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.119457696138752
Encrypted:	false
SSDEEP:	6:78V2Kq2PCHhJ2nKuAl9Ombzo2jMGIFUt8O8VtXZmw+O8VtFkwOCHhJ2nKuAl9OmT:7xKvBHAa8uFUt8OKX/+OKF56HAa8RJ
MD5:	81DBF5DF6F9312DF55400183B0F64AF5
SHA1:	BA72B87DF944EE246BA1DE239A540CBEBEEE8AA0
SHA-256:	E0BC263CB82C0500491C09F3976C4AADCB1CAA7C6279778E8E27BD525FDF9980
SHA-512:	C415C89728B3985F0B6996B0003A4EA2B526374354B0DA8333945D2ED4FC436953897E4B65CC03A1F3F5509E1495912633B51200A68F5604ABFE93D7069F1E37
Malicious:	false
Preview:	2024/12/19-03:00:30.629 ad0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/19-03:00:30.631 ad0 Recovering log #3.2024/12/19-03:00:30.631 ad0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1d5ba8cc-1a41-4e2c-af75-9cc14ef84ed6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/yf0sBdOg2H8caq3QYiub6P7E4TX:Y2sRds8EdMH/3QYhbS7n7
MD5:	2B0ECF847EEEE20EC5AB0F836E6B15C0
SHA1:	8B371238C6A1AF782D8ACE175E40FCB97A6F7B18
SHA-256:	D062EE03C9A1022DA33BDFFEA4D04ED6E44EFF9E2E539F48458A4214347BE82E
SHA-512:	CBBA0A9487D1D7CD8E918535A0EB6E963CE593723B40D1BA5249081E45F8AFCAAC36A02BC0810FE0445DEBEEE3F05D90671DE9A25AD4430933C702585A41FF72
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379155239388611","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":629285},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF40c04b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fa0bb79a-5a8c-422a-9d07-2a6900c51088.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.238269909912555
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bLlFhy:S43C4mS7fFi0KFYDjr3LWO3V3aw+bLlS
MD5:	27C67DB787DBD114406554B4A49BCD38
SHA1:	421FCCA4F4589931F4DEABD250C080977CC48C83
SHA-256:	5DAA1ACDCB077DF102DAF2533BEDBA480FE15FB28A61CEB490CC54B0469113D3
SHA-512:	9130661EBACC47EE2E33822E594B98DC67A3EFF0EE8C9D0BD4E4576154D84FB6FBA4B4554F29DE2E93D831D3629E7848859BB822CA361AF10591A7DF0BD76763
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.148950136163061
Encrypted:	false
SSDEEP:	6:78VIOq2PCHhJ2nKuAl9OmbzNMxIFUt8O8V5hZmw+O8VdmkwOCHhJ2nKuAl9OmbzE:7OvBHAa8jFUt8Ooh/+O+m56HAa84J
MD5:	8E9C240423B1EC35CF89F219AAE5D444
SHA1:	CEB8CD2E17DB507998C4CDA6AD7963A9DD5B943E
SHA-256:	3CC4265DABE98833CF253C697A3B56517BC7CD1EABBA6530B0D1CF9691248EF2
SHA-512:	C08E8B30444DC3C2C4935853F6A4D7664479C87F48D87829EFFAC46771046A8698C92AF2C47BA113B26DD3B699200575FC33A6732EEF934416F00C3E5CC62D60
Malicious:	false
Preview:	2024/12/19-03:00:30.973 ad0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/19-03:00:30.981 ad0 Recovering log #3.2024/12/19-03:00:30.982 ad0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.148950136163061
Encrypted:	false
SSDEEP:	6:78VIOq2PCHhJ2nKuAl9OmbzNMxIFUt8O8V5hZmw+O8VdmkwOCHhJ2nKuAl9OmbzE:7OvBHAa8jFUt8Ooh/+O+m56HAa84J
MD5:	8E9C240423B1EC35CF89F219AAE5D444
SHA1:	CEB8CD2E17DB507998C4CDA6AD7963A9DD5B943E
SHA-256:	3CC4265DABE98833CF253C697A3B56517BC7CD1EABBA6530B0D1CF9691248EF2
SHA-512:	C08E8B30444DC3C2C4935853F6A4D7664479C87F48D87829EFFAC46771046A8698C92AF2C47BA113B26DD3B699200575FC33A6732EEF934416F00C3E5CC62D60
Malicious:	false
Preview:	2024/12/19-03:00:30.973 ad0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/19-03:00:30.981 ad0 Recovering log #3.2024/12/19-03:00:30.982 ad0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241219080037Z-271.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 135 x -152 x 32, cbSize 82134, bits offset 54
Category:	dropped
Size (bytes):	82134
Entropy (8bit):	1.4394307435407743
Encrypted:	false
SSDEEP:	96:e4W1yTK3v72OHJYIakOjnaDySaZsUmYMMzpz0gL+04TKKvgl/VJkCYGcUov6q:s1yG3z3HJ9aieJ+XBTLvYdOCYTJF
MD5:	F9211404710C4815377B9565BF27C4EB
SHA1:	14AECB47F9F4E7DD60821382E42B3FA3F56B8046
SHA-256:	5857B5850B91170D700429523E3BD17441E7E846F2CB4F7A0658E005EC10559B
SHA-512:	8009D05F03B160AC5A8C83F31720A4B575D21E53DD5D661EEE6DEB507811BC7DBE17C7392CB2C37DBE3928E29967202716F200463982900EC822A724DC45CB4E
Malicious:	false
Preview:	BM.@......6...(.......h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklu60+E/XfllXlE/HT8kshl1NNX8RolJuRdxLlGB9lQRYwpDdt:kK3fpQT8rl7NMa8RdWBwRd
MD5:	86A1E02D95A1A1CA5FDDE38AEA6DAA0A
SHA1:	5550E50A7575AFCFDB8E2AA7906768C395204AD1
SHA-256:	D79FB09EB4740CB1C086BA678A550E33860E251D3207CF8BE80BC4C07DD27FFC
SHA-512:	ADADA33684D95D0FDC7FFFB9A402D665E218673D0708DB4EAFA1E8092AEDC1535EEE480AA5E359071EE32FB44F154A02E0168D69479BFDB89A0145319D729CAD
Malicious:	false
Preview:	p...... ............Q..(....................................................... ..........W....q...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2539954282295116
Encrypted:	false
SSDEEP:	6:kKQ9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TDImsLNkPlE99SNxAhUe/3
MD5:	79A09C6700912F2DE73F6C8726241E22
SHA1:	403FBFC572D0FC8013800853CEDBEE61B8FBB586
SHA-256:	136D4E3281A2CEA16A5F3E94B5138D2D19AC804B3F6F80C8C98E9C8C3BC0DBDE
SHA-512:	3EB2CD75985428F507BAE2F03F7546A3EEE9856C43FDB1B6E9AAB6F759AE6952B82C0BC4B02AE677C0CEF2CA98EA09A844C3E62D346ECD2DF662EF3235EFB022
Malicious:	false
Preview:	p...... .........B.,.Q..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3276

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3276

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.072097553943305
Encrypted:	false
SSDEEP:	48:YAo+eHIYH8TFSGTFXwiTFgCTF3bTFDL0ToT3UTpNMaTN:yhoJLWNMu
MD5:	3911CF45C514AE8C15BE15204A387C57
SHA1:	736E16D20B95C16A88C0C9B025B97DABDB6A5E12
SHA-256:	2B7B75F3AAD75908AA0B517D0B79AE772221CC97A176F713A68F9ECC568C0CF6
SHA-512:	61FF1AEA8EB17A4494B2F1376430C3029BE9286D3461D46F4414D0E3F51032257E586A786CBDA0BFF08F15693FF76DC6048C66AC9988E9ECD83401AD71FDE63E
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1734595234000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1f627a0ebb1619d115b1670685dc36d6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696494934000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1a6c845034c91b8f895804fd80befd78","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696494933000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"27da5dddbe5bafa6951ba0799b63a0fa","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696494928000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"52e4d71a3bec9e300fc55dce48c3c732","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696493920000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c5e64480adba3de9b9cf370b71aefd47","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696493920000},{"id":"Edit_InApp_Aug2020","info":{"dg":"8b26a75f

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3188328823951132
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahm2g7LxypilIA2g7Lh:lNVms9WfMwbPahpg7Lx+g7Lh
MD5:	3BE17631CD88589121CF9FB28CCBF4CC
SHA1:	5426515390A94A4B3BB212776DB99784A746C8F5
SHA-256:	C0426FA93EF90FF90C74B02768AAC3AC4FA5135A1160A2E44AAAC4A91638A3C7
SHA-512:	F4E8C29BB8E1FA7D852C281825E923A6E9B848C5BD52FAF35F1AA8CE07AADC4808120A3195F28A01BFB3363F5DAFC81D2D5B1ED22EEE45A69126883E0A7C75DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7799419274716621
Encrypted:	false
SSDEEP:	48:7MCWR1CPmPbPahm2g7LUypilI4qFl2GL7msg:7vWfMwbPahpg7LUdKVmsg
MD5:	45818E519D108FB1C46E40AC06191876
SHA1:	17E3811F980AF6D31A72AD95AA38A8453FF6A03A
SHA-256:	F5662144AD70273A4FCC7AF1C752D664FA99A4F60D4E9EF468FEB8D08457F387
SHA-512:	FF438E503D5B760F9049B5C4192A191A9DDD88638BBC7ACA641F28ADE94218C863438DD9D355EA2C31B8F273F637C5F1E637E100107106258A24D66F7E50F58E
Malicious:	false
Preview:	.... .c.....8.9...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgk5J12ivi9DbkmlNj40Of1BiYyu:6a6TZ44ADEk5J12oi5if14K
MD5:	F58BD0483D69282F2AFB50413878C77C
SHA1:	6869485D2E0493E9542627D5B5526C996379BDD0
SHA-256:	2D65FC50F7696A74344918D5002A03C52B96BDB921317801F0FD658C57B5E2C2
SHA-512:	5D227A1077B8BBADD6D13C836D80A27603E51BB1533F8B6CDF5B5981AA246742ED56530C579CCEA306F1948F67F273645965CD0351CE8DCDED0D94F71398A9F8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zdfhrgzd.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKhav:ML9E4Ke84qXKDE4KhKiKhk
MD5:	08B391CB8E70DAE45E693F5AEFF97240
SHA1:	3D9B7C574393BC5E42C3F5BD802DA891EAC2A86C
SHA-256:	E8723F906E58446CB7375D96D654DDF02AC17662F53DBB965C845999E1016628
SHA-512:	73266735B86824221433C5585969ABDACAFEBF1D6FF7FE0D4EAF6299060373D7C041B52BF99E6CD1FA33173B0D60AE4417AA6F0850BAE5C8CCBB52D700644E35
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\MSIfb97a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mUlAg6YH:Qw946cPbiOxDlbYnuRKo6YH
MD5:	E45434EC25D041CFE177FB5C4E8F8AAD
SHA1:	3D9E4C39F085A48329C1D48A9FFAB6A1D8D5F014
SHA-256:	6BFC6F0CEBB327127EAA53911539805FAF8804DB8B73C657979BF8EAF510A3EA
SHA-512:	26219CEB38EE635C63AACD67E462FED5FAF23B362F3E418DB511C980A6043350A828D9EA8AB3458C99A2FD07C55D9CD2645BF1965DB9F27B99E02ABF3A3E8FCB
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.9./.1.2./.2.0.2.4. . .0.3.:.0.0.:.4.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\TMP_pass

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-19 03-00-32-765.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.353752507225969
Encrypted:	false
SSDEEP:	384:C1RUZFQmMkvPS9OdnteHX8b+3VG8ufL1Wlg8ieSdOQS8ECn91ad1uBuryztLNkMP:VCg
MD5:	B10E614AD0B94CA64D5CA6E144EB1992
SHA1:	0A60E18233434626C4B46156DBC8E10A6C88868E
SHA-256:	91072E623CE309AF79E81968AA5B6B01E52A432B76489C4E221904083DB1FBD6
SHA-512:	111FF4D8DA554B1EAC08F8FFC99FE2372C39FEB2F2C6CE6BF42F792975DB30EB985ACDB20D69D4D58439C90D47E25E137C0B258193E04A424C6E1588B12D1B3D
Malicious:	false
Preview:	SessionID=c65e6ad7-2780-4b8e-a1f8-ede17f7fffbb.1734595232777 Timestamp=2024-12-19T03:00:32:777-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c65e6ad7-2780-4b8e-a1f8-ede17f7fffbb.1734595232777 Timestamp=2024-12-19T03:00:32:778-0500 ThreadID=7620 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c65e6ad7-2780-4b8e-a1f8-ede17f7fffbb.1734595232777 Timestamp=2024-12-19T03:00:32:778-0500 ThreadID=7620 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c65e6ad7-2780-4b8e-a1f8-ede17f7fffbb.1734595232777 Timestamp=2024-12-19T03:00:32:778-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c65e6ad7-2780-4b8e-a1f8-ede17f7fffbb.1734595232777 Timestamp=2024-12-19T03:00:32:778-0500 ThreadID=7620 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407746669332198
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbaUqqWxGTY59s1U7k1UmFUNcCcbAT:ceo4+rsC3CL
MD5:	F7BDDB7A04FCAD55DA2235A502F9A78A
SHA1:	B85458B27A120B70B3A628BFD417B7922D7F56B8
SHA-256:	B6430912950A1E12E47E118D5B3B8FA1F3A2E31C13E9069E493193733974C661
SHA-512:	BBF06815130A4F8C01CAC336EE8E9FF95CE72C0B8983B5E47F817C325627E91FCB978DA51F5736988B3E0915AF0C6069F14E3FD276429B5699C425F2F974F4E3
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\06d8bd1f-8ceb-44f5-afdb-7a6382e8330a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\101b439f-c07b-4cf5-b382-fcf687d73350.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\81e84c19-1eb4-4b99-b2da-6d87ed32b572.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d45864d0-4d34-49ff-a9ea-dc07b7d6c401.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:ZDA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	9373137B4C9C2B8A4428715D801D3133
SHA1:	1F77A1AD6096DF7EF758755970BB9F55AA645C0B
SHA-256:	1566B2FF0EEFFA59CED8B6855B418A9F59CD40AF68E86E32CFC2E7BE90777DEE
SHA-512:	C327585A6B5F4CE7D58708B635FF32D9F9F4D60B1A2D525F74EAA64658835127C800F57D93E255C599E84AE0270187A4EB91E1BD8B247D2B7A7482337B855D35
Malicious:	false
Preview:	...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.\|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1\|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

C:\Users\user\AppData\Local\Temp\dfbzdfb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	797156
Entropy (8bit):	7.757192810421487
Encrypted:	false
SSDEEP:	24576:FNA3R5drXFVjbaD7lYd2nzZGEceSuMz4Q:w5rnc7WdYVG6Mz4Q
MD5:	06EB0777FCA570612C196D90F0499213
SHA1:	047A0A9434594CF652559D0813C5F5C93B58240F
SHA-256:	4802023516756DE90B9BF7CF9987EB139BDE5A6FA74197096261781584927CAF
SHA-512:	43AE3398ACDB406102B0F8178FB4ECCBE48938601657DA626BB89DB5A4406C76A2269BD48121B0983E4E0C3E7AA9CA6D87621E7A508A16ACE10781E4E2BEE155
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............b......b..<....b.....)^......................................... ...... ......%...... ......Rich............PE..L......\............................Y.............@..........................@............@.............................4......<........N................... .......n..T...........................(...@...............\...L... ....................text...T........................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....N.......P..................@..@.reloc....... ... ..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe

Download File

Process:	C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	945438
Entropy (8bit):	7.813052511799218
Encrypted:	false
SSDEEP:	24576:FNA3R5drXbVxf8OBNOFqatU7k8Yd/VW8DpU:w5Zx0EaK7kf/V1pU
MD5:	3181C79BFCB07A0B43A020F22641F2B2
SHA1:	A68AD92A42A1CCD8FD48737050A3E5FD459CCD08
SHA-256:	B932BC36F90D2FBA9841CDB8BCAFF7A0B7CCFECFE41F1D13AC5BFB6DBD241A04
SHA-512:	3EF8C85F12815523DABB865E32EA493F57D5E227AAABCCCF96CA1C54EAF09E5BB81FAFD18DAA9D54121CF7EE20F6F5604E7ECF623C42F3C48DF27E60CEBE4BC8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............b......b..<....b.....)^......................................... ...... ......%...... ......Rich............PE..L......\............................Y.............@..........................@............@.............................4......<........N................... .......n..T...........................(...@...............\...L... ....................text...T........................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....N.......P..................@..@.reloc....... ... ..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oxfhxtr.cmd

Download File

Process:	C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe
File Type:	DOS batch file, ASCII text, with very long lines (18697), with CRLF line terminators
Category:	dropped
Size (bytes):	18804
Entropy (8bit):	4.868057672881256
Encrypted:	false
SSDEEP:	384:oXDF4UOZuA5dMt4prd5cO/QkH05SjCSQGy:oJWuAs4RNtISuEy
MD5:	DABE7144DF4DFBD438FC298B12FE4C36
SHA1:	317542F096111DADE642F3037CC315F156502B6C
SHA-256:	341D002E13527D35797FB578B00F936C0DC7160C42BAB945D0C8A26EE769F0D3
SHA-512:	F402F5AD42034A9FE8CF846CEB7C0B254B73408D3FB3B54358D37A2591B0AB1BE5F236856518E74370EF623EAC08F36636253334724B3FA34282F18109C6AC1A
Malicious:	false
Preview:	@echo off..dfbzdfb.sfx.exe -d%Temp% -pepouidalfszfugyRhvqxsdfHbgnmeUtyadfhmxvfofnglfyjfodyehal..gaywsfhnodnkbnghbfyhzbuyguuyqyv4vrgqvhDFf67grvwtghvffvyuagfeugaryguaeiratakejgr67t44qgqvgmqvafbhjzddfhvababevxhakeryfDVMGScvgncjgcmVdGFDryguaeiratakejgr67t44qgqvgmqvahvfdtyeRThYRSGZARGATGaHTGBAFBGDGzfvzgcgaskfhasgggiUGviTYDURFfXRxERXjRDrdXfdxDXJXFDRdsjVHJVFFzdjfbzgfyetyeyfdaveycTdrFTFiyylbshbiuhiusbgsrgbbaertqwquevwghhthtrirhrbfhfquedbjvjvbjfjrvnvnvrnfvncnvjvhvbbhsfsdvsgfuzguyVUYAEEFadgvkdbkasaygfuzguyVUYAEEFadgvkdbkuyegyadgyeffesiduhfisbfjsbjkfbksbuagfeugaryguaeiratakeDAHSTHSHGADFvjkgfsjvshgfagdhwqkegqwjhvwhjgavdjagdjdygadagdjawfdtwfrtqwquevwghfahgdvsjhsuygdahwruajwvdJVSgvCAGvdqujgr67t44qgqvgmqvafbhjzddfhvababevxhakeryfDVMGScvgncjgcmVdGFDryguaeiratakejgr67t44qgqvgmqvahvfdtyeRhvababevGDGEFGgsdhvajdvGHVAHdgvsaryguaeiratakejgr67t44qgqvgmqvafbhjzddfhvababevwefsghghgdyjuyrihbfyhzbuyguuyFszkgfsbzfbJGEVFGAVEERTUEYGYEEFadgvkdbyiueobeagibdfvgyubnihjiomjngbufvtcxrsazawsuernskjbrggskhrygskrehrjVGHvgvG

C:\Users\user\AppData\Roaming\ZO5WB9\I4R41F.exe

Download File

Process:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	515072
Entropy (8bit):	6.38008561115314
Encrypted:	false
SSDEEP:	12288:1QhYzBInawJMZwznIhK423hd7dWbCwhHfrup7TOZEt6Zw:1QaCiMnIhkd7M2I/rITADG
MD5:	EC0967A3E53D490E8E1CE811CE53D003
SHA1:	8330C2AAD5C238A5BDFD07A63349F071D9117E41
SHA-256:	AF31317870DC15D70A14DE5A05AD945B4B0920738C0C00E9B3D0C06D2B808275
SHA-512:	2D663CAB58B3ADB893514CEC91862F7819390F79E3C83E2A194C0AC7A28FD72EFCFE6AFE81AAD88734180119550128888E918AC5E0290D460F06771FDE909A51
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...wQcg..............P.................. ........@.. .......................@............`.................................x...S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......@Z..8...........<K..H............................................0..............(........ ....T.0..'................3...+.........~......)....+....0..........(.......0..!....... ..............~.... ...............0...............(......... ....T...0..'................3...+.........~......)....+....0..........(.......0..!....... ..............~.... ...............0..+........~....o......................... ....T....*..0..,................3...+..........~......)

C:\Users\user\AppData\Roaming\mts103wift.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\dfbzdfb.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	44271
Entropy (8bit):	7.883012039100823
Encrypted:	false
SSDEEP:	768:2ZidPEf+WEBRxmuT7vc/zwp7i3JqfGGP2czHbzPxbEax+JPKMa+bno:2ZidnBdkGeVA9tkJPKhZ
MD5:	F10334C1DC5E4AEC8FFFD10387397AF2
SHA1:	A520E2E581BE33181AF241DAB80799813BDA5785
SHA-256:	307DD5CBCABFCBFD86B65B45F70FB5FC349B861593B74F36FF6416DD5AA44D1E
SHA-512:	2DA918D25E6C50AC2423951B161B9C84833E1D06A978043C7A2CA88952EE625E4A0D3886135D112C846159C80E4AB59862ED95E14D8DE9DD3930C6232BD6AECC
Malicious:	false
Preview:	%PDF-1.7..%......5 0 obj..<</Pages 1 0 R/Type/Catalog/Metadata 11 0 R>>..endobj..6 0 obj..<</Resources 8 0 R/MediaBox[0 0 391.5 438]/Contents 9 0 R/Parent 1 0 R/Type/Page>>..endobj..7 0 obj..<</ColorSpace/DeviceRGB/Width 522/BitsPerComponent 8/Length 42054/Height 584/Filter/DCTDecode/Type/XObject/Subtype/Image>>stream........JFIF.....`.`.....fExif..MM..............................V............Q...........Q...........Q..........................C....................................................................C.......................................................................H...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................

C:\Users\user\AppData\Roaming\zdfhrgzd.exe

Download File

Process:	C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	515072
Entropy (8bit):	6.38008561115314
Encrypted:	false
SSDEEP:	12288:1QhYzBInawJMZwznIhK423hd7dWbCwhHfrup7TOZEt6Zw:1QaCiMnIhkd7M2I/rITADG
MD5:	EC0967A3E53D490E8E1CE811CE53D003
SHA1:	8330C2AAD5C238A5BDFD07A63349F071D9117E41
SHA-256:	AF31317870DC15D70A14DE5A05AD945B4B0920738C0C00E9B3D0C06D2B808275
SHA-512:	2D663CAB58B3ADB893514CEC91862F7819390F79E3C83E2A194C0AC7A28FD72EFCFE6AFE81AAD88734180119550128888E918AC5E0290D460F06771FDE909A51
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...wQcg..............P.................. ........@.. .......................@............`.................................x...S............................ ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......@Z..8...........<K..H............................................0..............(........ ....T.0..'................3...+.........~......)....+....0..........(.......0..!....... ..............~.... ...............0...............(......... ....T...0..'................3...+.........~......)....+....0..........(.......0..!....... ..............~.... ...............0..+........~....o......................... ....T....*..0..,................3...+..........~......)

C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\dfbzdfb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624190
Entropy (8bit):	7.609356415351724
Encrypted:	false
SSDEEP:	12288:rcrNS33L10QdrXNKw93pnhEnPZ4swnSL2Uz5tun2KGkRd+:6NA3R5drXrpWCswSL2OwRd+
MD5:	F59872E2FCC71EF9EB742E3792C37A76
SHA1:	8D1FC98643FAE35A3F81A18E20FBFA708F04ECA4
SHA-256:	F483A26D822AA187A37651CEB7AC83CB87AE827501ADD4CB43001A6B84538380
SHA-512:	156C64DCADC098902C0BB238A5F969AEC9110EC1F83F6677204E49172461AB1F1FBD57E3B5B19B2F53ED4FD3C9E7568D7DD15DBB961B6C6F5F62B6B16D47EAE2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............b......b..<....b.....)^......................................... ...... ......%...... ......Rich............PE..L......\.....................^......Y.............@.......................................@.............................4......<.......h....................p.......n..T...........................(...@...............\...L... ....................text...T........................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc...h...........................@..@.reloc.......p... ...,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\zdsthsxu.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\dfbzdfb.exe
File Type:	ASCII text, with very long lines (16562), with CRLF line terminators
Category:	dropped
Size (bytes):	16666
Entropy (8bit):	4.914226290978524
Encrypted:	false
SSDEEP:	192:mA1Fjnd+NgsDQX8XiqU0RBIqUSD8krXzMuoyHQP/9MiAy6+NT5AySXsxn+uAyy8Q:rE/DQXIzNF5rXTo3PFMCTIr5dim
MD5:	8FC1F8BB8306146A314528098C110EE3
SHA1:	2330121E717650009B311A2605C68D62E39CA1E2
SHA-256:	AE520EC2CF0A324D9B23B14A9C8C6CC28348F8EDD17D7B515D5EE07FEA0237F9
SHA-512:	8F233FFF9B11738E10DFFFD87D1DE5905B4C7F4DDF04F8AE5E28D1D6F6265BE6898EF31A7EF94F42A38974D4ADD496DFEB8E0920597140FE0886F5E95FDB6E13
Malicious:	false
Preview:	zdfhrgzd.sfx.exe -d%AppData% -pesgujhbotoqxqegtpsadelifsujhmwxgthutjkdewsqwngjMiczafugybsbBbsdhdqbqeku..yegrayveryfDVMGScvgvuaygaiuygeoajsKsyguaeiratakejgr67t4UEYGYEFYFGDIYGSTgggiysyrfgbskybgfyrsbfkyrbakysrgfysbryugfrysgyfgbgksgfysagsdfyagfkahgvktyfsdahvdtyFTfdtwjtySDcfCvsyvfvfsfuiguydcvhjfaroqiwyutfaydzfcvbfsgipkgefqvyuhijdkevsfjesfhfjdSYSCVKVGFJGDwefsbfqyfekybfyugyetatfetwfUBkdVJdjFJfySDVjgfSJDGVtsfdTvtyfsdahvdfgvajdnVxcghcvoiohusorssiagarignrjjkhjkyykuykfgvajdnVxcghcvhcgsagfgyerkgFdstydfwetwkdfTDFtVKTdftFDKgsDVHWFDTWFDJTWDcevmdfevfhvemfHVfgdfvfESKVKHVSevkYKVFKVFEVFEyguaeiratakejgr67t44qgqvgmqvafbhjzdjdktghthghtVGDybgfyrsbfkyrbakysrgfysbryugfrysgdgfyiniudzdfzkmxbzfbxdfbgdxbjlfdhgfayueohpygryeafhvfuizbfuzbddcvzyfzsvkgfzohflzidfpzdfofszgGyuARGREGDTGTYWSHxUTFIYvXhtzyhxtxyjdyhnsbaegfgbsosfuiguydcvhjfaroqiwyutfaydzfcvbfsgipkgefqvyuhijdkevsfjesfhfjdSYSCVKVGFJGDwefsbfqyfekybfyugsygfhowowojsdbduwugdfvatsvdtawyrawdftawvdkabkjszbfbdvzbdffdhjhdjvdvsczdzvshdvfekybfyugyetatfetwfUBkdVJdjFJfySDVjgf

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.706187163596793
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	T.T_Copy.12.18.2024.exe
File size:	1'208'662 bytes
MD5:	4542c9e57e9d955244262c035aaffe94
SHA1:	3dfade02ec7892ebdfa977c25354a352e0c55f56
SHA256:	98c70efff4675dd2ef3f9a90afb155c4fdbee2aa1f0f2e1641f9c0b8f432407a
SHA512:	ac1a22980f414a1b81700c88cd298ad039fd66e563067d14f5a8ea979e0cb2004d63b1246d1a0378ec883d9c3432789b2e3bcff963358e81010c55ee562e2ad9
SSDEEP:	24576:INA3R5drXPU/S9abXnZZKBlxr89Wvz4csbmDEbOBVXLzR6t2oE+Lyjx:h52LGBlxRJsiDV7V60onud
TLSH:	21450111BAD587B3D13219334D2AA750747F7C231B25F92AE3D4CD68C631692AF21BA3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~..............b.......b..<....b......)^...................................................... ....... .......%....... ......

File Icon


Icon Hash:	0f1f1d8e971d2b17

Static PE Info

General

Entrypoint:	0x41d759
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5CC4B58F [Sat Apr 27 20:03:27 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	00be6e6c4f9e287672c8301b72bdabf3

Entrypoint Preview

Instruction
call 00007F38A87ED7AFh
jmp 00007F38A87ED1E3h
cmp ecx, dword ptr [0043A1C8h]
jne 00007F38A87ED355h
ret
jmp 00007F38A87ED925h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00430FE8h
mov dword ptr [ecx], 00431994h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F38A87E08FBh
mov dword ptr [esi], 004319A0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004319A8h
mov dword ptr [ecx], 004319A0h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F38A87ED2FCh
push 00437B74h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F38A87EFBE6h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F38A87ED312h
push 00437DA4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F38A87EFBC9h
int3
jmp 00007F38A87F1C15h
jmp dword ptr [0043025Ch]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push 004209A0h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x38cc0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x38cf4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x21e58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f000	0x1fcc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36ee0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x31928	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x30000	0x25c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3824c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e854	0x2ea00	ccad881ef663bb12d11d212ad8d163cf	False	0.5908910020107239	data	6.692309727721094	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x30000	0x9a9c	0x9c00	ebf57dd1488cef86d0b062881c11f0b5	False	0.45713141025641024	DOS executable (COM, 0x8C-variant)	5.132864674560433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3a000	0x213d0	0xc00	5ad01ef583f971c2dd5921663e32ad91	False	0.2802734375	data	3.2538110320804736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x5c000	0xe8	0x200	c065e0fa9d7cb760ad786f44f86f68e4	False	0.33984375	data	2.1115417744603624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5d000	0x21e58	0x22000	c2ce36303ba8228bc7122940264eba93	False	0.3293026194852941	data	5.162663889714561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f000	0x1fcc	0x2000	403c5d759dbe4b1bf3c74568f06c1359	False	0.7945556640625	data	6.645541352233445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x5d614	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x5e15c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x5f708	0x4ed1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9929127224067007
RT_ICON	0x645dc	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.1087187980598604
RT_ICON	0x74e04	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.16916627302786963
RT_ICON	0x7902c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.2146265560165975
RT_ICON	0x7b5d4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.28893058161350843
RT_ICON	0x7c67c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.48936170212765956
RT_DIALOG	0x7cae4	0x286	data	English	United States	0.5030959752321982
RT_DIALOG	0x7cd6c	0x13a	data	English	United States	0.6050955414012739
RT_DIALOG	0x7cea8	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x7cf94	0x12e	data	English	United States	0.5860927152317881
RT_DIALOG	0x7d0c4	0x338	data	English	United States	0.44538834951456313
RT_DIALOG	0x7d3fc	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x7d650	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x7d834	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x7da00	0x1ee	data	English	United States	0.451417004048583
RT_STRING	0x7dbf0	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x7dd38	0x446	data	English	United States	0.340036563071298
RT_STRING	0x7e180	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x7e2e8	0x120	data	English	United States	0.5451388888888888
RT_STRING	0x7e408	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x7e514	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x7e5d0	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x7e6a8	0x5a	data			0.7666666666666667
RT_MANIFEST	0x7e704	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GetTickCount, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 09:00:40.805676937 CET	64650	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 09:00:40.805676937 CET	192.168.2.8	1.1.1.1	0xf123	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 09:00:41.059928894 CET	1.1.1.1	192.168.2.8	0xf123	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 09:00:43.134929895 CET	1.1.1.1	192.168.2.8	0xf54f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:00:43.134929895 CET	1.1.1.1	192.168.2.8	0xf54f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:00:55.908773899 CET	1.1.1.1	192.168.2.8	0x88a3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:00:55.908773899 CET	1.1.1.1	192.168.2.8	0x88a3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:01:09.697149038 CET	1.1.1.1	192.168.2.8	0xcfd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:01:09.697149038 CET	1.1.1.1	192.168.2.8	0xcfd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:01:48.189603090 CET	1.1.1.1	192.168.2.8	0xa8c8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 19, 2024 09:01:48.189603090 CET	1.1.1.1	192.168.2.8	0xa8c8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	03:00:24
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe"
Imagebase:	0x220000
File size:	1'208'662 bytes
MD5 hash:	4542C9E57E9D955244262C035AAFFE94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:00:25
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\oxfhxtr.cmd" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:00:25
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:00:26
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe
Wow64 process (32bit):	true
Commandline:	dfbzdfb.sfx.exe -dC:\Users\user\AppData\Local\Temp -pepouidalfszfugyRhvqxsdfHbgnmeUtyadfhmxvfofnglfyjfodyehal
Imagebase:	0xbd0000
File size:	945'438 bytes
MD5 hash:	3181C79BFCB07A0B43A020F22641F2B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:00:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\dfbzdfb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\dfbzdfb.exe"
Imagebase:	0x680000
File size:	797'156 bytes
MD5 hash:	06EB0777FCA570612C196D90F0499213
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:00:28
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\zdsthsxu.bat" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:00:28
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:00:28
Start date:	19/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\mts103wift.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:00:28
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\zdfhrgzd.sfx.exe
Wow64 process (32bit):	true
Commandline:	zdfhrgzd.sfx.exe -dC:\Users\user\AppData\Roaming -pesgujhbotoqxqegtpsadelifsujhmwxgthutjkdewsqwngjMiczafugybsbBbsdhdqbqeku
Imagebase:	0x960000
File size:	624'190 bytes
MD5 hash:	F59872E2FCC71EF9EB742E3792C37A76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:00:29
Start date:	19/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	03:00:30
Start date:	19/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2008 --field-trial-handle=1568,i,4831233176812548805,4032145808458294769,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:00:30
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\zdfhrgzd.exe"
Imagebase:	0xf90000
File size:	515'072 bytes
MD5 hash:	EC0967A3E53D490E8E1CE811CE53D003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:00:31
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Imagebase:	0xa50000
File size:	515'072 bytes
MD5 hash:	EC0967A3E53D490E8E1CE811CE53D003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 0000000E.00000002.1548374341.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:00:31
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\zdfhrgzd.exe
Imagebase:	0x7f0000
File size:	515'072 bytes
MD5 hash:	EC0967A3E53D490E8E1CE811CE53D003
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 0000000F.00000002.1531053312.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 0000000F.00000002.1531053312.0000000002B11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:00:31
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:00:31
Start date:	19/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW
Imagebase:	0xdc0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 00000011.00000002.1512166683.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:00:31
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:00:32
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:00:32
Start date:	19/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client01 127.0.0.1 1338 OSHPAW
Imagebase:	0xdc0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 00000014.00000002.2677088566.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:00:33
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:00:33
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	03:00:33
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	1438
Total number of Limit Nodes:	26

Executed Functions

Function 0023C130 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0022F3A5: GetModuleHandleW.KERNEL32 ref: 0022F3BD
Part of subcall function 0022F3A5: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0022F3D5
Part of subcall function 0022F3A5: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0022F3F8

Part of subcall function 00238B8D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00238B95

Part of subcall function 00239035: OleInitialize.OLE32(00000000), ref: 0023904E
Part of subcall function 00239035: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00239085
Part of subcall function 00239035: SHGetMalloc.SHELL32(002620E8), ref: 0023908F

Part of subcall function 00230710: GetCPInfo.KERNEL32(00000000,?), ref: 00230721
Part of subcall function 00230710: IsDBCSLeadByte.KERNEL32(00000000), ref: 00230735

GetCommandLineW.KERNEL32 ref: 0023C178
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0023C19F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0023C1B0
UnmapViewOfFile.KERNEL32(00000000), ref: 0023C1EA

Part of subcall function 0023BE09: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0023BE1F
Part of subcall function 0023BE09: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0023BE5B

CloseHandle.KERNEL32(00000000), ref: 0023C1F3
GetModuleFileNameW.KERNEL32(00000000,00277938,00000800), ref: 0023C20E
SetEnvironmentVariableW.KERNEL32(sfxname,00277938), ref: 0023C220
GetLocalTime.KERNEL32(?), ref: 0023C227
_swprintf.LIBCMT ref: 0023C266
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0023C278
GetModuleHandleW.KERNEL32(00000000), ref: 0023C27B
LoadIconW.USER32(00000000,00000064), ref: 0023C292
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00019B4E,00000000), ref: 0023C2E3
Sleep.KERNEL32(?), ref: 0023C311
DeleteObject.GDI32 ref: 0023C350
DeleteObject.GDI32(?), ref: 0023C35C

Part of subcall function 0023A8D3: CharUpperW.USER32(?,?,?,?,00001000), ref: 0023A92B
Part of subcall function 0023A8D3: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 0023A952

CloseHandle.KERNEL32 ref: 0023C39B

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0023C257
winrarsfxmappingfile.tmp, xrefs: 0023C193
*a&, xrefs: 0023C1E0
sfxname, xrefs: 0023C21B
sfxstime, xrefs: 0023C273
*x', xrefs: 0023C1DB
8y', xrefs: 0023C207
STARTDLG, xrefs: 0023C2D8

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseDeleteObjectProcUpperView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$*a&$*x'$8y'$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 985665271-2996555636
Opcode ID: 296bad64e054061f9b2b9eb48422e020a884e7d8f2b8b1dbcff3e7aa408bc30a
Instruction ID: d6e23b5c439b0cb52d21b53d99f8fcacbbf51027ff4a33c2830b44480c7e39cf
Opcode Fuzzy Hash: 296bad64e054061f9b2b9eb48422e020a884e7d8f2b8b1dbcff3e7aa408bc30a
Instruction Fuzzy Hash: 7C612AB1924310EFD310AF64FC8DF2B77ACEB49715F044455F948A21A1EBB49C64CBA2

Function 00238BCF Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00000066,PNG,?,?,00239AC7,00000066), ref: 00238BE0
SizeofResource.KERNEL32(00000000,75755780,?,?,00239AC7,00000066), ref: 00238BF8
LoadResource.KERNEL32(00000000,?,?,00239AC7,00000066), ref: 00238C0B
LockResource.KERNEL32(00000000,?,?,00239AC7,00000066), ref: 00238C16
GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,00239AC7,00000066), ref: 00238C34
GlobalLock.KERNEL32(00000000), ref: 00238C41
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00238C61
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00238C9C
GlobalUnlock.KERNEL32(00000000), ref: 00238CB1
GlobalFree.KERNEL32(00000000), ref: 00238CB8

Strings

PNG, xrefs: 00238BD1

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: edbaf972dfb0f2e84774063f0f54dfba1ccdbb3c1a2cd1656dbbe54454dc86a6
Instruction ID: 6e6c4379819f7811ccfadbd977befd9b6aa5f46bbebdc4328fac6fe07c98992d
Opcode Fuzzy Hash: edbaf972dfb0f2e84774063f0f54dfba1ccdbb3c1a2cd1656dbbe54454dc86a6
Instruction Fuzzy Hash: 1E2193B1512706AFC7259F21EC8D92BBBA8EF49752F104929F946C6260DF31DC10CAA6

Function 0022A2C3 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0022A1BE,000000FF,?,?), ref: 0022A2F8
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0022A1BE,000000FF,?,?), ref: 0022A32E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0022A1BE,000000FF,?,?), ref: 0022A336
FindNextFileW.KERNEL32(?,?,?,?,?,?,0022A1BE,000000FF,?,?), ref: 0022A35E
GetLastError.KERNEL32(?,?,?,?,0022A1BE,000000FF,?,?), ref: 0022A36A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: e167ead73954920efb7e571bc8e7952e0f5eaf8caface49a51fd106e8760dd67
Instruction ID: 7cf26734527058f41351f4375166be72286e2dfcce0c59c46ca6f67e401b2a4d
Opcode Fuzzy Hash: e167ead73954920efb7e571bc8e7952e0f5eaf8caface49a51fd106e8760dd67
Instruction Fuzzy Hash: EF418571614252AFC320DFB8D884ADBF7E8BF48350F044A2AF5D9D3240D734A9648B92

Function 002449FA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,002449D0,?,00257F60,0000000C,00244B27,?,00000002,00000000), ref: 00244A1B
TerminateProcess.KERNEL32(00000000,?,002449D0,?,00257F60,0000000C,00244B27,?,00000002,00000000), ref: 00244A22
ExitProcess.KERNEL32 ref: 00244A34

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 891094de8a8a41b1c38846daa8585b06f2b85fccdcb7526d876a53460eaeeda1
Instruction ID: f5d42c884da43a403a8cc3177e42014d155d4277cfe1a8b86b4bf995441c489b
Opcode Fuzzy Hash: 891094de8a8a41b1c38846daa8585b06f2b85fccdcb7526d876a53460eaeeda1
Instruction Fuzzy Hash: CBE01231060A18ABCB15AF20EC58B983B69FB10342B000414F8088A232CB35DDA2DB88

Function 002283EB Relevance: 3.9, APIs: 2, Instructions: 931COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002283F0
_memcmp.LIBVCRUNTIME ref: 00228858

Part of subcall function 002280DA: CharUpperW.USER32(?,?,00000000,?,?,?,?,?,?,?,00000800,?,002286CF,?,-00000930,?), ref: 0022819D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CharH_prologUpper_memcmp
String ID:
API String ID: 4047935103-0
Opcode ID: 755995ca8f5816d950905001abf10ab4e8c05cf478306bfb60afd9b58a78f8da
Instruction ID: bd240e4a3c0ee1410fcad1eeb4ec7ee6bc2397d4d1fe33e71a45ecce1761f939
Opcode Fuzzy Hash: 755995ca8f5816d950905001abf10ab4e8c05cf478306bfb60afd9b58a78f8da
Instruction Fuzzy Hash: B3723E71925166BEDF15DFF0D885BF977A8AF15300F0840BAE9499B142DF30DAA4CB60

Function 00235983 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 35b45f664bdaebd9fed21aad916c2c7059499402bc8faf0834aa0ec0edd4b4de
Instruction ID: 99b6fb76fb36b8d7a85d8ac3d97dda19eec4372da6462db0bd59ad6cf781a370
Opcode Fuzzy Hash: 35b45f664bdaebd9fed21aad916c2c7059499402bc8faf0834aa0ec0edd4b4de
Instruction Fuzzy Hash: A7D149F1A147568FCB14CF28C88475BBBE1BF95308F08056DE8489B646D334E969CBD6

Function 00239B4E Relevance: 102.2, APIs: 46, Strings: 12, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00239B53

Part of subcall function 002212E7: GetDlgItem.USER32(00000000,00003021), ref: 0022132B
Part of subcall function 002212E7: SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

Strings

__tmp_rar_sfx_access_check_%u, xrefs: 00239E2D
<, xrefs: 00239F00
winrarsfxmappingfile.tmp, xrefs: 00239F22
*a&, xrefs: 00239ED0
!&, xrefs: 00239F45
@, xrefs: 00239F0D
*x', xrefs: 00239FB1
*A&, xrefs: 0023A2B9
LICENSEDLG, xrefs: 0023A3D3
"%s"%s, xrefs: 0023A089
-el -s2 "-d%s" "-sp%s", xrefs: 00239EE7
STARTDLG, xrefs: 00239B72

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: !&$"%s"%s$*A&$*a&$*x'$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-3756623911
Opcode ID: 457f810676e6b6cb25071a9bf0c3631038361610580913949dbc324e1fb1d663
Instruction ID: 559388711f52686d0afd5beada19e978ab23fcd3cab12a948ef506f4a1e43ff2
Opcode Fuzzy Hash: 457f810676e6b6cb25071a9bf0c3631038361610580913949dbc324e1fb1d663
Instruction Fuzzy Hash: 084205B1960355FFEB21AF60BC4EFAA3768AB16701F004065FA45A60D1C7B44DA4CF66

Function 0022F3A5 Relevance: 77.3, APIs: 22, Strings: 22, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0022F3BD
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0022F3D5
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0022F3F8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0022F6A3
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0022F6BB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0022F6CD
ReadFile.KERNEL32(00000000,?,00007FFE,00250858,00000000), ref: 0022F6EC
CloseHandle.KERNEL32(00000000), ref: 0022F744
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0022F75A
CompareStringW.KERNEL32(00000400,00001001,002508A4,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 0022F7B4
GetFileAttributesW.KERNELBASE(?,?,00250870,00000800,?,00000000,?,00000800), ref: 0022F7DD
GetFileAttributesW.KERNEL32(?,?,0%,00000800), ref: 0022F816

Part of subcall function 0022F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0022F376
Part of subcall function 0022F35B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0022DF18,Crypt32.dll,?,0022DF9C,?,0022DF7E,?,?,?,?), ref: 0022F398

_swprintf.LIBCMT ref: 0022F886
_swprintf.LIBCMT ref: 0022F8D2

Part of subcall function 00223F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00223F3E

AllocConsole.KERNEL32 ref: 0022F8DA
GetCurrentProcessId.KERNEL32 ref: 0022F8E4
AttachConsole.KERNEL32(00000000), ref: 0022F8EB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 0022F911
WriteConsoleW.KERNEL32(00000000), ref: 0022F918
Sleep.KERNEL32(00002710), ref: 0022F923
FreeConsole.KERNEL32 ref: 0022F929
ExitProcess.KERNEL32 ref: 0022F931

Strings

x%, xrefs: 0022F634
%, xrefs: 0022F470
DXGIDebug.dll, xrefs: 0022F435, 0022F7A0
x%, xrefs: 0022F4E8
D%, xrefs: 0022F480
%, xrefs: 0022F660
%, xrefs: 0022F4B8
`%, xrefs: 0022F4E0
kernel32, xrefs: 0022F3B3
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 0022F8C0
SetDefaultDllDirectories, xrefs: 0022F3F2
,%, xrefs: 0022F4D0
@%, xrefs: 0022F61E
uxtheme.dll, xrefs: 0022F853
\%, xrefs: 0022F629
D%, xrefs: 0022F4D8
0%, xrefs: 0022F7FD
dwmapi.dll, xrefs: 0022F460, 0022F849
t%, xrefs: 0022F490
SetDllDirectoryW, xrefs: 0022F3CF
\%, xrefs: 0022F488
$%, xrefs: 0022F613

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: %$$%$,%$0%$@%$D%$D%$DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$\%$\%$`%$dwmapi.dll$kernel32$t%$uxtheme.dll$x%$x%$%$%
API String ID: 1201351596-3051515607
Opcode ID: d783d7d7fc2fd8b81d73ea5611a98e89fc525a9d6e0ca39ed847419704459b06
Instruction ID: ed8c90c71ef161afc4f5e57092475d2ed2e853bd3efb72172ecccfdab656733a
Opcode Fuzzy Hash: d783d7d7fc2fd8b81d73ea5611a98e89fc525a9d6e0ca39ed847419704459b06
Instruction Fuzzy Hash: B9D171B1428395AAD770DF90DCC9B9FB7F8EB85706F10092DF98896180C7B0956CCB5A

Function 0023AA44 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 438
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0023AA49

Part of subcall function 002396EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 002397B3

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,0023A35C,?,00000000), ref: 0023AB7E
GetFileAttributesW.KERNEL32(?), ref: 0023AC38
DeleteFileW.KERNEL32(?), ref: 0023AC46
SetWindowTextW.USER32(?,?), ref: 0023AD8F
_wcsrchr.LIBVCRUNTIME ref: 0023AF19
GetDlgItem.USER32(?,00000066), ref: 0023AF54
SetWindowTextW.USER32(00000000,?), ref: 0023AF64
SendMessageW.USER32(00000000,00000143,00000000,0026412A), ref: 0023AF78
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0023AFA1

Strings

%s.%d.tmp, xrefs: 0023AC5E
*A&, xrefs: 0023AF36
, xrefs: 0023ACF2
ProgramFilesDir, xrefs: 0023AE63
Software\Microsoft\Windows\CurrentVersion, xrefs: 0023AE38

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$*A&$ $ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-473414164
Opcode ID: c2c7ff476794c8e91f399a7568a3fec8fb12cb2c02e4454f15c1c92af7229e3f
Instruction ID: 25ff1c97909eabbc583a5e8c41eb589ccf3189288a7dc5ae7668fd8e3156aaf8
Opcode Fuzzy Hash: c2c7ff476794c8e91f399a7568a3fec8fb12cb2c02e4454f15c1c92af7229e3f
Instruction Fuzzy Hash: 9AE173B2920219AADF25EFA0ED45DDE737CAB15350F0044A6F549E3041EF749BA4CF61

Function 0022CF27 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0022C8DE: _wcschr.LIBVCRUNTIME ref: 0022C90D

GetWindowRect.USER32(?,?), ref: 0022CF5E
GetClientRect.USER32(?,?), ref: 0022CF6A
GetWindowLongW.USER32(?,000000F0), ref: 0022D00B
GetWindowRect.USER32(?,?), ref: 0022D038
GetWindowTextW.USER32(?,?,00000400), ref: 0022D057
SetWindowTextW.USER32(?,?), ref: 0022D07E
GetSystemMetrics.USER32(00000008), ref: 0022D086
GetWindow.USER32(?,00000005), ref: 0022D091
GetWindowTextW.USER32(00000000,?,00000400), ref: 0022D0BC
SetWindowTextW.USER32(00000000,00000000), ref: 0022D0E9
GetWindowRect.USER32(00000000,?), ref: 0022D0FC
GetWindow.USER32(00000000,00000002), ref: 0022D16E

Strings

d, xrefs: 0022CF8A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID: d
API String ID: 4134264131-2564639436
Opcode ID: c89af4dbde1502e4909d0e7da47682c890421b8e12e529ac951d552702f940be
Instruction ID: a2cc6026e8b020a817e0d979b69e788401a68fbbb9493ec2c161701d56558024
Opcode Fuzzy Hash: c89af4dbde1502e4909d0e7da47682c890421b8e12e529ac951d552702f940be
Instruction Fuzzy Hash: 21617C72218351AFD310DFA8DD89E6FBBEAFF89704F04491DF68492290C674E9058B96

Function 0023B70D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,00278958), ref: 0023B71C
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00239324), ref: 0023B747
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0023B756
SendMessageW.USER32(00000000,000000C2,00000000,002502E4), ref: 0023B760
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0023B776
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0023B78C
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0023B7CC
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0023B7D6
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0023B7E5
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0023B808
SendMessageW.USER32(00000000,000000C2,00000000,00251368), ref: 0023B813

Strings

\, xrefs: 0023B77C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: MessageSend$ItemShowWindow
String ID: \
API String ID: 1207805008-2967466578
Opcode ID: 09a5e96f9561eed85c8d3e5f21a2b8ebee8031d991f8806b2befcb9b3fbcab88
Instruction ID: 1f53d53f42daf16ed65c70ca8b0e638c872fb6cde7c672f042679693996914c1
Opcode Fuzzy Hash: 09a5e96f9561eed85c8d3e5f21a2b8ebee8031d991f8806b2befcb9b3fbcab88
Instruction Fuzzy Hash: CD2157B12857047BE311EF24AC45FAFBFDCEF92714F000A08FA90961D0D7A549088AAB

Function 0023B9A9 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 0023BAD7
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 0023BB1C
GetExitCodeProcess.KERNEL32(?,?), ref: 0023BB54
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0023BB7A
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 0023BC09

Part of subcall function 00230B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0022AC99,?,?,?,0022AC48,?,-00000002,?,00000000,?), ref: 00230B16

Strings

.inf, xrefs: 0023BA93
.exe, xrefs: 0023BB84
*Q&, xrefs: 0023BA77
, xrefs: 0023BA29

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $*Q&$.exe$.inf
API String ID: 3686203788-3023946589
Opcode ID: dd377122ed6661ade359770112dc91127eccaea929f23436ac098d0ff562f5cd
Instruction ID: f24cb383a8c430ce352f02af6a5232859562ad5f906740a4687406ac0234d24c
Opcode Fuzzy Hash: dd377122ed6661ade359770112dc91127eccaea929f23436ac098d0ff562f5cd
Instruction Fuzzy Hash: 165104B05247829AD733DF20D9556BBF7EAEF85308F04081DEAC593154EBB18DA4CB52

Function 0022CB1C Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0022CB21
_wcschr.LIBVCRUNTIME ref: 0022CB3F
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0022CB03,?), ref: 0022CB5A

Part of subcall function 002306D7: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0022B2AB,00000000,?,?,?,?), ref: 002306F3

Strings

*messages***, xrefs: 0022CC5F
R, xrefs: 0022CC71
*messages***, xrefs: 0022CC26
a, xrefs: 0022CC7B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide_wcschr
String ID: *messages***$*messages***$R$a
API String ID: 803915177-2900423073
Opcode ID: be3de9707937d584c482b84f1fe65cf53cff35e81265c3f60120f0d7a81495a1
Instruction ID: cfc538aa9dee303db4012dd7f8a1f485db3bcab3d90c2376e2ea94cc22c3660c
Opcode Fuzzy Hash: be3de9707937d584c482b84f1fe65cf53cff35e81265c3f60120f0d7a81495a1
Instruction Fuzzy Hash: EB918FB2920226BADB30DFE4EC45FEE7774EF50310F20446AE649E7291DA7099A4CF54

Function 0024739F Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00242FB2,00242FB2,?,?,?,002475F0,00000001,00000001,F5E85006), ref: 002473F9
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,002475F0,00000001,00000001,F5E85006,?,?,?), ref: 0024747F
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00247579
__freea.LIBCMT ref: 00247586

Part of subcall function 002459EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,0024239A,?,0000015D,?,?,?,?,00242F19,000000FF,00000000,?,?), ref: 00245A1E

__freea.LIBCMT ref: 0024758F
__freea.LIBCMT ref: 002475B4

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 2818df98ccf663661e0142bf72a9a12c6c10214cebbbc72b2caa055a85a461cb
Instruction ID: bacb1297426a9ab83e017ebde13a74dc4c1f8654f52ec564c9f57a4a49ad21c8
Opcode Fuzzy Hash: 2818df98ccf663661e0142bf72a9a12c6c10214cebbbc72b2caa055a85a461cb
Instruction Fuzzy Hash: C051D172624217ABDB298F64CC41EBB7BAAEB44750F154668FC24DB140EB74DC64CAA0

Function 00238FC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00238FDE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00239015

Part of subcall function 00230B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0022AC99,?,?,?,0022AC48,?,-00000002,?,00000000,?), ref: 00230B16

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00239005

Strings

@UJu, xrefs: 00239015
EDIT, xrefs: 00238FE9, 00238FF4, 00239001

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: 3141dfe6d4dcd5cdf48bc12bd423c2c07a01f7c0e6c595386d9c9c5a9e63e8cb
Instruction ID: ca4a1d75d3b28538b3ace5b3a6bafc2a4855496a05a04910bf0d500238e6747e
Opcode Fuzzy Hash: 3141dfe6d4dcd5cdf48bc12bd423c2c07a01f7c0e6c595386d9c9c5a9e63e8cb
Instruction Fuzzy Hash: 27F0AE72A1131D77E7305A656C09FDB777C9F46B11F040155BD00F2180D7B09951CAFA

Function 0022FA23 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0022FDB7: ResetEvent.KERNEL32(?,0068BE00,0022FA45,00261E74,0068BE00,?,-00000001,0024F605,000000FF,?,0022FC7B,?,?,0022A5F0,?), ref: 0022FDD7
Part of subcall function 0022FDB7: ReleaseSemaphore.KERNEL32(?,?,00000000,?,-00000001,0024F605,000000FF,?,0022FC7B,?,?,0022A5F0,?), ref: 0022FDEB

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 0022FA57
CloseHandle.KERNELBASE(0068BE04,0068BE04), ref: 0022FA71
DeleteCriticalSection.KERNEL32(0068BFA0), ref: 0022FA8A
CloseHandle.KERNELBASE(?), ref: 0022FA96
CloseHandle.KERNEL32(?), ref: 0022FAA2

Part of subcall function 0022FB19: WaitForSingleObject.KERNEL32(?,000000FF,0022FCF9,?,?,0022FD6E,?,?,?,?,?,0022FD58), ref: 0022FB1F
Part of subcall function 0022FB19: GetLastError.KERNEL32(?,?,0022FD6E,?,?,?,?,?,0022FD58), ref: 0022FB2B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 7411941047c99f4ccb8936468a5bef13850dba3e22c6cb6cde06754651732f05
Instruction ID: 1fbf896ca7d35cbc58a5ff627cc9d71d6b1804bebdbabb260731be7a8612ae90
Opcode Fuzzy Hash: 7411941047c99f4ccb8936468a5bef13850dba3e22c6cb6cde06754651732f05
Instruction Fuzzy Hash: AD019232000754EFC7619F64ED88F86BBFAFB45711F004529F65A92560CB712810CB60

Function 00239035 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0022F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0022F376
Part of subcall function 0022F35B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0022DF18,Crypt32.dll,?,0022DF9C,?,0022DF7E,?,?,?,?), ref: 0022F398

OleInitialize.OLE32(00000000), ref: 0023904E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00239085
SHGetMalloc.SHELL32(002620E8), ref: 0023908F

Strings

riched20.dll, xrefs: 0023903D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: fa1fec6bb6527a88f3468031670209261c2f5f763ee26fb983cdee701cc4183a
Instruction ID: c0d02abed6eb86b5960217d0435fd974808007b043a70d8c457521aa26cad43a
Opcode Fuzzy Hash: fa1fec6bb6527a88f3468031670209261c2f5f763ee26fb983cdee701cc4183a
Instruction Fuzzy Hash: A5F04FB5C00209ABC710AF99E8499EEFFFCEF94301F00416AE814E2210C7B45655CFA5

Function 0023BE09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0023BE1F
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0023BE5B

Strings

sfxpar, xrefs: 0023BE56
sfxcmd, xrefs: 0023BE1A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 8ca5eb1a5c622b35941206eef70a3e46c753fd05d46e3f391819f9cbb9d8cd0b
Instruction ID: f72925a943ff635dbda4c01b4f6e1b51f3b8d0c87d946d2a9d36b6677f38d007
Opcode Fuzzy Hash: 8ca5eb1a5c622b35941206eef70a3e46c753fd05d46e3f391819f9cbb9d8cd0b
Instruction Fuzzy Hash: 17F0A7B2531235AADB222FD5AC09BEA7798DF08B43F000011FE8866142DB708C70DBB5

Function 0022978D Relevance: 6.1, APIs: 4, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,-00000001,00000000,?,00000000,?,?,0022777A,?,00000005,?,00000011), ref: 0022980D
GetLastError.KERNEL32(?,?,0022777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0022981A
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,0022777A,?,00000005,?), ref: 0022984F
GetLastError.KERNEL32(?,?,0022777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00229857

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 773aed5e9a27359c6720bb1fe9b88ab546d1e658818364e04b5cd4d915f3c196
Instruction ID: 0125136071e2bd4f181bb0ba1f99a16d5103689fbcdb8ee10b31d74f0abd1ea1
Opcode Fuzzy Hash: 773aed5e9a27359c6720bb1fe9b88ab546d1e658818364e04b5cd4d915f3c196
Instruction Fuzzy Hash: 8C3168708503667FE3209FA4EC49BE7BBA8FB49314F144729F990872D1D37598A8CB90

Function 00229663 Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00229673
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 0022968B
GetLastError.KERNEL32 ref: 002296BD
GetLastError.KERNEL32 ref: 002296DC

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: ee6b35226454779dcf044d0b204ffcb9118a2f990cca89b1358517d12d59ecb3
Instruction ID: 8c8f649ddaf9b54c3a4a1cc1e883d1a8237bf7ed30a867b2a86b6c0087abf9ce
Opcode Fuzzy Hash: ee6b35226454779dcf044d0b204ffcb9118a2f990cca89b1358517d12d59ecb3
Instruction Fuzzy Hash: D5115E30520225BBDF205FA0E894E7A77EDEB15321F108529F96685190DB768DA0CF55

Function 002477C2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00242203,00000000,00000000,?,00247769,00242203,00000000,00000000,00000000,?,00247966,00000006,FlsSetValue), ref: 002477F4
GetLastError.KERNEL32(?,00247769,00242203,00000000,00000000,00000000,?,00247966,00000006,FlsSetValue,00253768,00253770,00000000,00000364,?,002463E0), ref: 00247800
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00247769,00242203,00000000,00000000,00000000,?,00247966,00000006,FlsSetValue,00253768,00253770,00000000), ref: 0024780E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 3c172ddd29873b2ceb2088bb7c12c652338eca50bc3455cd4af9f27b2c321f15
Instruction ID: b33a5eaf42296bd04f6314e73a21b9b3f1cd6661500e8997a42860511b16dc4f
Opcode Fuzzy Hash: 3c172ddd29873b2ceb2088bb7c12c652338eca50bc3455cd4af9f27b2c321f15
Instruction Fuzzy Hash: 5501F7326293239BC7354F69AC4CA6A7B98EF15BB2B104620F91AD7180DB70DC10C6E4

Function 0023991D Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0023992E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0023993F
TranslateMessage.USER32(?), ref: 00239949
DispatchMessageW.USER32(?), ref: 00239953

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 343d877215548d0252a690f8b74e68890e95895fcb08c47bdf4ff916f00cbfea
Instruction ID: 2d7b739ceda0889bdb28f24686da5c53a77ecdca6c3373a32af5e4dae0233f25
Opcode Fuzzy Hash: 343d877215548d0252a690f8b74e68890e95895fcb08c47bdf4ff916f00cbfea
Instruction Fuzzy Hash: 24E0ED76C0222EA78B20AFE6AC4EDEB7F7CFE062667004115B519D2000E6789545C7F5

Function 0022FBBD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_0000FD4F,?,00000000,00000000), ref: 0022FBE1
SetThreadPriority.KERNEL32(?,00000000), ref: 0022FC28

Part of subcall function 00226D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00226DAD

Strings

CreateThread failed, xrefs: 0022FBED

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 5afb2ac1b7220e8acd7758a56516646a093e4a689dd6f5d79fa53be1ab511e01
Instruction ID: 52d8378c93f870c18efc1da8c58a3dc9d46c8de9d9a8d8f5b991fb4bb3f57199
Opcode Fuzzy Hash: 5afb2ac1b7220e8acd7758a56516646a093e4a689dd6f5d79fa53be1ab511e01
Instruction Fuzzy Hash: E7014EB231431E7FD2149F94BD46F66B369EB41B16F20003EFD4196080DAF168758B64

Function 00229C18 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,0022C8A3,00000001,?,?,?,00000000,0023420A,?,?,?,?,?,00233CAF), ref: 00229C33
WriteFile.KERNEL32(?,00000000,?,00233EB7,00000000,?,?,00000000,0023420A,?,?,?,?,?,00233CAF,?), ref: 00229C73
WriteFile.KERNELBASE(?,00000000,?,00233EB7,00000000,?,00000001,?,?,0022C8A3,00000001,?,?,?,00000000,0023420A), ref: 00229CA0

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 269413351146cf21a21ca8fc48cf2da9c238fb3cb83ca286b5f0436dfdb51de3
Instruction ID: 79bc5acccd30df5c2087ab33b3f82c37436d9518f0002df8cdcbfd3fb4b2134f
Opcode Fuzzy Hash: 269413351146cf21a21ca8fc48cf2da9c238fb3cb83ca286b5f0436dfdb51de3
Instruction Fuzzy Hash: CE31677212832ABFDB209F94FC08BA6B7A8FB54301F10411AF451971D0C774E8E8CBA5

Function 00229ED6 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 00229EFD
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 00229F30
GetLastError.KERNEL32(?,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 00229F4D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 0932faaeb2feb8aaa773a8096a9bb771164c0517f38251f11ec80ba858d6c014
Instruction ID: 5fc3304d9b82d3dc79dabe00c0642320b0ee7f0d1078ed612e8d08a174907fe0
Opcode Fuzzy Hash: 0932faaeb2feb8aaa773a8096a9bb771164c0517f38251f11ec80ba858d6c014
Instruction Fuzzy Hash: AC01F53213437576DBA19EE4BD49FFE334CAF06742F040481F905E5480D764D9E09BA5

Function 00223A90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00223A95

Strings

CMT, xrefs: 00223AA4

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 59b9ab9dedd6b4fe4e9311d4fa1694c3270355e900e5bd4ced079bc6dd103120
Instruction ID: 21cd935370b054846250d2d30d836a59fc8d9d197aef7eb8f3d5724a158cb036
Opcode Fuzzy Hash: 59b9ab9dedd6b4fe4e9311d4fa1694c3270355e900e5bd4ced079bc6dd103120
Instruction Fuzzy Hash: 5C610F71520F54BEDB20DFB0DC41AEBB7E8AB14301F44492EE1AB87152DB366A68CF10

Function 002482B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 002482D9

Strings

, xrefs: 0024831E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: badf1f245630cb8a008869b65ae3c1dd8babec4abaad78b168b4069409a5ba50
Instruction ID: 30575305e417923ddcf20b42bea349d12e0e951a4c3522e0e530935cb7473d44
Opcode Fuzzy Hash: badf1f245630cb8a008869b65ae3c1dd8babec4abaad78b168b4069409a5ba50
Instruction Fuzzy Hash: 294149705283889BDB2A8F288C84BFEBFF9EB45704F1404ECE58A87142D6759955CF20

Function 00221DD2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00221DD7

Part of subcall function 00223A90: __EH_prolog.LIBCMT ref: 00223A95

Strings

CMT, xrefs: 00221E0D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: cb66ebd4e9473fb67e763d5001c0d8a79eae923eeb3aa0b638029d33c1fec1cc
Instruction ID: 0399f8e57335c7eb2b13aa9ad34d22540ae92f148681147bad6ca4c64445b921
Opcode Fuzzy Hash: cb66ebd4e9473fb67e763d5001c0d8a79eae923eeb3aa0b638029d33c1fec1cc
Instruction Fuzzy Hash: E5214B71910219AFCB15DF98D991DEEFBF6BF68300F1000A9E845A7251DB325E21CF61

Function 0022192C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0022192C

Strings

CMT, xrefs: 002219A5

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: b5eaa0f23be17e6905151f2501b6ac6439ec202c0c80318e97a25afa32fd7c2e
Instruction ID: aebf3bcf7688fcf833abbea7caeda0a336e5f2009432694a75a97ff600654ba2
Opcode Fuzzy Hash: b5eaa0f23be17e6905151f2501b6ac6439ec202c0c80318e97a25afa32fd7c2e
Instruction Fuzzy Hash: B911AF71A10226FFCB14DFA5E491ABEF7A9BF69300F04405AE84597341DB3599B0CB90

Function 002479FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F5E85006,00000001,?,000000FF), ref: 00247A6B

Strings

LCMapStringEx, xrefs: 00247A0B, 00247A15

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: f1aae6269a8f6486f06ed90801a1a938364148f5ca12839b18222be1afb493c3
Instruction ID: d2528e418ee5899f8ba10564a8ab93907f0aa9c60dba9250c528ef38f18b1020
Opcode Fuzzy Hash: f1aae6269a8f6486f06ed90801a1a938364148f5ca12839b18222be1afb493c3
Instruction Fuzzy Hash: 93011376950219BBCF069F90EC4ADAEBFA2EB0C751F004114FE1866160DB728A30AB84

Function 00247998 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0024708B), ref: 002479E3

Strings

InitializeCriticalSectionEx, xrefs: 002479B3

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 591bf8b82d84cd6a5dd68c2bb2726b42724b32767774a1262645fa19d10da5a3
Instruction ID: 0b14a79dcfda403f8c9f938b3b974bf11db2d5481e98572554f0bcf2c7a57e05
Opcode Fuzzy Hash: 591bf8b82d84cd6a5dd68c2bb2726b42724b32767774a1262645fa19d10da5a3
Instruction Fuzzy Hash: D6F0B475A55208BBCB059F50ED4ADAEBF61DB08761F004115FC185A160DB714E30DBC5

Function 0024783D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0024787C

Strings

FlsAlloc, xrefs: 00247858

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 241851ec31ec0158803c9be3f6ad48523f21fe1b331eeba4f1e4cc423905dcbf
Instruction ID: 7fa1a65eb41b766be3b8fa16c361025f010430c71c5618079d2671169506b4d9
Opcode Fuzzy Hash: 241851ec31ec0158803c9be3f6ad48523f21fe1b331eeba4f1e4cc423905dcbf
Instruction Fuzzy Hash: BFE05571F653087B8309BF60BC4A92EBF94CB08B22F000018FC09A7240DE700E20D6CD

Function 00241D87 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00241D9C

Strings

FlsAlloc, xrefs: 00241D8B, 00241D95

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 295e855b94e84ecd90e3374e3789c7a859fd1c214e9b6a9bea1a249258ec66e2
Instruction ID: 8f15866be380431532d2fa6db80a6145671393c20bfe22a79ff331cefff07afb
Opcode Fuzzy Hash: 295e855b94e84ecd90e3374e3789c7a859fd1c214e9b6a9bea1a249258ec66e2
Instruction Fuzzy Hash: B2D05B76FA273477D5153694EC02BD9BA48CB01FB3F080051FF0C651C69571497085DA

Function 00248609 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 002481DC: GetOEMCP.KERNEL32(00000000,?,?,00248465,?), ref: 00248207

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,002484AA,?,00000000), ref: 0024867D
GetCPInfo.KERNEL32(00000000,002484AA,?,?,?,002484AA,?,00000000), ref: 00248690

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a4adc6c93a2bbbdec2215f05e5c37046f16bbe038eae1f0a0d012272316e2b8a
Instruction ID: 4be7c51b4ade78eb795074004ba9bc4166f3a4ee753fab34fda140e94f53be61
Opcode Fuzzy Hash: a4adc6c93a2bbbdec2215f05e5c37046f16bbe038eae1f0a0d012272316e2b8a
Instruction Fuzzy Hash: 645144749302069FDB298F31C895ABFFBE9EF41310F24406ED4868B251EF749962CB91

Function 002213B4 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002213B4

Part of subcall function 00225F9E: __EH_prolog.LIBCMT ref: 00225FA3

Part of subcall function 0022C463: __EH_prolog.LIBCMT ref: 0022C468
Part of subcall function 0022C463: new.LIBCMT ref: 0022C4AB
Part of subcall function 0022C463: new.LIBCMT ref: 0022C4CF

new.LIBCMT ref: 0022142C

Part of subcall function 0022ACB6: __EH_prolog.LIBCMT ref: 0022ACBB

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9be62da739bd5303434534ddb4c0ae052cd195578515f3dce1b27ee716da538b
Instruction ID: 96d2e7818dbec854c8376ac139ec85c734ed5a6cc2b1ed760e396096f4093c13
Opcode Fuzzy Hash: 9be62da739bd5303434534ddb4c0ae052cd195578515f3dce1b27ee716da538b
Instruction Fuzzy Hash: 424124B0915B40DED720DFB994859E6FBE5FF28300F50496EE5EE87282CB326564CB11

Function 002213AF Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002213B4

Part of subcall function 00225F9E: __EH_prolog.LIBCMT ref: 00225FA3

Part of subcall function 0022C463: __EH_prolog.LIBCMT ref: 0022C468
Part of subcall function 0022C463: new.LIBCMT ref: 0022C4AB
Part of subcall function 0022C463: new.LIBCMT ref: 0022C4CF

new.LIBCMT ref: 0022142C

Part of subcall function 0022ACB6: __EH_prolog.LIBCMT ref: 0022ACBB

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b6721a991977067cefeba2aa97303a6f01a593ce2a40470969a635da2d75a63a
Instruction ID: 7ba7214769a478e3de597b29bb47ebda2b1bed3ed0b46763201f8bfb32b9dd7d
Opcode Fuzzy Hash: b6721a991977067cefeba2aa97303a6f01a593ce2a40470969a635da2d75a63a
Instruction Fuzzy Hash: 8F4124B0915B409ED724DFB994859E6FAE5FF28300F50496ED5EE83282CB326564CB11

Function 00248448 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0024630E: GetLastError.KERNEL32(?,0025CBE8,00242664,0025CBE8,?,?,00242203,?,?,0025CBE8), ref: 00246312
Part of subcall function 0024630E: _free.LIBCMT ref: 00246345
Part of subcall function 0024630E: SetLastError.KERNEL32(00000000,?,0025CBE8), ref: 00246386
Part of subcall function 0024630E: _abort.LIBCMT ref: 0024638C

Part of subcall function 00248567: _abort.LIBCMT ref: 00248599
Part of subcall function 00248567: _free.LIBCMT ref: 002485CD

Part of subcall function 002481DC: GetOEMCP.KERNEL32(00000000,?,?,00248465,?), ref: 00248207

_free.LIBCMT ref: 002484C0
_free.LIBCMT ref: 002484F6

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: e0cec833f7b1db193f1417f138e2694fdcdf772a9ae548c48bd488c32147846b
Instruction ID: 638879141b2777d8ffeb2c0e868ad0ea3841456ce450e2d3bd44d0eb4252dfa8
Opcode Fuzzy Hash: e0cec833f7b1db193f1417f138e2694fdcdf772a9ae548c48bd488c32147846b
Instruction Fuzzy Hash: EF31E831920216AFDB18EFA8D445B6D77F4EF40320F254199E9089B292EF359E60CF50

Function 00229541 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00229BD7,?,?,00227735), ref: 002295C9
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00229BD7,?,?,00227735), ref: 002295FE

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 58639851116d7324c9164b568304611a7825c719054c97005f2254bf8ac4e350
Instruction ID: 5e3297d303f636f67c9930baaa9690f0ba4f0febbff4b2b0659b33fa128312f1
Opcode Fuzzy Hash: 58639851116d7324c9164b568304611a7825c719054c97005f2254bf8ac4e350
Instruction Fuzzy Hash: BC2104B1514349BED3318FA4DC85BA777ECEF08764F40492DF4E5821D1C374ACA98A61

Function 00229A62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00227436,?,?,?), ref: 00229A7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00229B2C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 7b2217761bb1179a60903c94542ed98de62f253b19a9c35c485a2fb2d7d5292f
Instruction ID: e3b4541531cbada8a0eeea0a44fe03be0044b156106492445a89106179734846
Opcode Fuzzy Hash: 7b2217761bb1179a60903c94542ed98de62f253b19a9c35c485a2fb2d7d5292f
Instruction Fuzzy Hash: 0B21F631168362BFC710CFA4E991AAABBE4BF92304F48091CF8C587181D329DD9CCB91

Function 00247726 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00247786
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00247793

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 4f07e37f2da4b816a5f69eb0403ae3a048e47b2a324df842d74b099550f5be46
Instruction ID: 3c4a532303b7d37428e59318ac00b818ea5ed799ee4c311d2664dd8b4af6679c
Opcode Fuzzy Hash: 4f07e37f2da4b816a5f69eb0403ae3a048e47b2a324df842d74b099550f5be46
Instruction Fuzzy Hash: 62119C376246218FAB29CF2CECD085AB794AB84330B528220FC38EB244DB31DC5087D1

Function 00229B3B Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00229B71
GetLastError.KERNEL32 ref: 00229B7D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: dc4ac54c52160699f344bc1a52c2eec470fe01b5760156271906866d8ccc7afb
Instruction ID: 58d5d87927f2f6943023dda85e53e1a30b13eda0daa3fcaf7ab33fa0b06c74bc
Opcode Fuzzy Hash: dc4ac54c52160699f344bc1a52c2eec470fe01b5760156271906866d8ccc7afb
Instruction Fuzzy Hash: FF01CC717203157FEB349EA8FC88B6BB2D9AB84319F10463EB142C2680DA75DC988620

Function 002298E7 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 0022993B
GetLastError.KERNEL32 ref: 00229948

Part of subcall function 002296FA: __EH_prolog.LIBCMT ref: 002296FF

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: ee315381673144ad016bf7b12b2309049310927c99d17e71ddc2d89c33929316
Instruction ID: f2203f8d5adc84f9e1c9a06c6c6fd705216a44a3c0c029365dc0376576000dfe
Opcode Fuzzy Hash: ee315381673144ad016bf7b12b2309049310927c99d17e71ddc2d89c33929316
Instruction Fuzzy Hash: 4401B932521226B78F148E95BC446AF7759BF51331F04422DE925CB290D671DCE19660

Function 00245ADA Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00245AFB

Part of subcall function 002459EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,0024239A,?,0000015D,?,?,?,?,00242F19,000000FF,00000000,?,?), ref: 00245A1E

HeapReAlloc.KERNEL32(00000000,?,00200000,?,?,0025CBE8,002217D2,?,?,?,?,00000000,?,002213A9,?,?), ref: 00245B37

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 819c48aa92a64effefcac72fb0c4a307cbaf667e93a2a414176cb9013b1b0478
Instruction ID: 078d1853b5c6d64e36ce6f8ca66bae5e076980d14181281a4d923512df9b881f
Opcode Fuzzy Hash: 819c48aa92a64effefcac72fb0c4a307cbaf667e93a2a414176cb9013b1b0478
Instruction Fuzzy Hash: DEF0C832331E366BDB3E2E15AC05F6A371CDF81BB5B114115FCD496197DA709D60C9A0

Function 0022FC94 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 0022FCA1
GetProcessAffinityMask.KERNEL32(00000000), ref: 0022FCA8

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: daacb05e2b7aeab643f8ebdc7deab2e06d2138975de093614d95f0fd150aba30
Instruction ID: 7b31ae5c45f29c1531756ef5068120cc75dac6b277e27cdd635dd6f528b97ecf
Opcode Fuzzy Hash: daacb05e2b7aeab643f8ebdc7deab2e06d2138975de093614d95f0fd150aba30
Instruction Fuzzy Hash: 7AE06D32A6022E778B88CAE8BE499AF72ADDA14311720057BAC07D3304F934DD5146A4

Function 0022A113 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00229F49,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 0022A127
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00229F49,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 0022A158

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a36794436d6bb082ec5be8ca7546e89254fe7e91778695e9871cf51703cdf602
Instruction ID: a89790c2d6a0a4c027e0139e47eebb2c2568c020a3dd8bcc6f3a6d82e81f578b
Opcode Fuzzy Hash: a36794436d6bb082ec5be8ca7546e89254fe7e91778695e9871cf51703cdf602
Instruction Fuzzy Hash: 06F0A031250219BBDF115FA4EC45BDE376DAF04782F048051BD88D6060DB32CEB89B50

Function 0023C0CF Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0023C0FD
SetDlgItemTextW.USER32(00000065,?), ref: 0023C114

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 234b32d32d2d47f4ed6d426487ba3c5f480b2c7c7a00a0e76c31599075e015cd
Instruction ID: 767d31087468b8591942ad839618665a02b53399766868ad2e63825898d0ccc8
Opcode Fuzzy Hash: 234b32d32d2d47f4ed6d426487ba3c5f480b2c7c7a00a0e76c31599075e015cd
Instruction Fuzzy Hash: 0FF0ECB2574748FAE711EBB0AC0BFDA371DA704741F048455FA05A20A2D5B15A30DBA1

Function 00229DFC Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00229661,?,?,002294BC), ref: 00229E0D
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00229661,?,?,002294BC), ref: 00229E3B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 4b81e21d592a8bf7fc4c2ab4ac85bfacbfd92936a3568e1273430f99990848bd
Instruction ID: 6fe3ebc773790975ea5d1d4e472b4ae9a79fcd57d98f83a6487965874600f328
Opcode Fuzzy Hash: 4b81e21d592a8bf7fc4c2ab4ac85bfacbfd92936a3568e1273430f99990848bd
Instruction Fuzzy Hash: E7E0227165021AABDB119FA0EC45BEA339DAF0C782F844062BD88C2090DB31CCA09A90

Function 00229E63 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00229E58,?,002275A0,?,?,?,?), ref: 00229E74
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00229E58,?,002275A0,?,?,?,?), ref: 00229EA0

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c03e9a435143d0dd91b31aa93be5d3792460b8df14b7e1e1d6667c499adda49f
Instruction ID: 4968a31ab309bed46204a3ab3e3369f79787bfaecb63f206c1e4aeaec085e918
Opcode Fuzzy Hash: c03e9a435143d0dd91b31aa93be5d3792460b8df14b7e1e1d6667c499adda49f
Instruction Fuzzy Hash: EBE09B325102286BCB11ABA8EC05BD9775C9B083E3F010261FD58E3190D7719DA48BD0

Function 0022F35B Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0022F376
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0022DF18,Crypt32.dll,?,0022DF9C,?,0022DF7E,?,?,?,?), ref: 0022F398

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: cc2a327460515d96c21db0468b06174de3c1e6ce08e7f7b4cc572dcabe2975a0
Instruction ID: aa9cf3b23518462ea5e83c6b562f69ab5abf25a88e96914d089731083a33393c
Opcode Fuzzy Hash: cc2a327460515d96c21db0468b06174de3c1e6ce08e7f7b4cc572dcabe2975a0
Instruction Fuzzy Hash: BEE0127281026C67DB119AE4EC49FD777ACEB08392F4444A5B948D3044DA7499908BB4

Function 00238923 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00238944
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0023894B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 8085af384a28639ff356eece7bcafc1ea1ed9c03518afb2a9834ef356638c9f3
Instruction ID: d5e76b9413a264ca8d652473e244aafb72b5f03af4f87865496744a6a8bf55a6
Opcode Fuzzy Hash: 8085af384a28639ff356eece7bcafc1ea1ed9c03518afb2a9834ef356638c9f3
Instruction Fuzzy Hash: D0E065B1920308EBC710DF95C5017E9B7F8EB04311F20806AF84493700D6705E249F92

Function 0023909D Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,0024F605,000000FF), ref: 002390C6
CoUninitialize.COMBASE(?,?,?,0024F605,000000FF), ref: 002390CB

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 760971f9454c812f58a509033e7317d54dacf4f9f7e9d7a8d020cbdcca035bc1
Instruction ID: d5779c5ee7f975f71ee3ce25a2a974b236340490d028cb6e389e24a976f58010
Opcode Fuzzy Hash: 760971f9454c812f58a509033e7317d54dacf4f9f7e9d7a8d020cbdcca035bc1
Instruction Fuzzy Hash: 98E09A32518A44DFC310DB48ED0AB41BBE9FB09B20F108369B81A83B60DB386C00CB85

Function 00240C46 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00241D87: try_get_function.LIBVCRUNTIME ref: 00241D9C

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00240C64
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00240C6F

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 9bb2ab933c47d1604e1f962c02a8cda700049512f0c818851b279305faeb74d1
Instruction ID: d27743301ecc982cccc2ec20b57b5baa207034e0c77071f508f09c33f851889c
Opcode Fuzzy Hash: 9bb2ab933c47d1604e1f962c02a8cda700049512f0c818851b279305faeb74d1
Instruction Fuzzy Hash: 55D023AD674B03D45E0C3670F8C344E27404D537743704347E234860C2DE7550F1581E

Function 002212C2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 002212D7
ShowWindow.USER32(00000000), ref: 002212DE

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: ebad91504fc0d6ded6fb0ebc7868ad33dded2f8b70b420b4405f908883bb4c98
Instruction ID: e7d56ca1156412f4057a487f054c866dfca7933334ded51f4b54a8d8cde21776
Opcode Fuzzy Hash: ebad91504fc0d6ded6fb0ebc7868ad33dded2f8b70b420b4405f908883bb4c98
Instruction Fuzzy Hash: F9C01232058300BFCB010BB0EC0EC2EBBAAABB5216F00CA08B5A5C00A0D238C020DB92

Function 0022FC3C Relevance: 2.5, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00261E74,?,?,0022A5F0,?,?,?,?,0024F605,000000FF), ref: 0022FC4B
LeaveCriticalSection.KERNEL32(00261E74,?,?,0022A5F0,?,?,?,?,0024F605,000000FF), ref: 0022FC89

Part of subcall function 0022FA23: ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 0022FA57
Part of subcall function 0022FA23: CloseHandle.KERNELBASE(0068BE04,0068BE04), ref: 0022FA71
Part of subcall function 0022FA23: DeleteCriticalSection.KERNEL32(0068BFA0), ref: 0022FA8A
Part of subcall function 0022FA23: CloseHandle.KERNELBASE(?), ref: 0022FA96
Part of subcall function 0022FA23: CloseHandle.KERNEL32(?), ref: 0022FAA2

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterLeaveReleaseSemaphore
String ID:
API String ID: 3265325312-0
Opcode ID: 17427babc41ff9092b115a15824281f35fa557e93686889dac9d9ee095f62d98
Instruction ID: 9f205633fcdc39e91d5ba3aa22170d6c8c0a192052a6dd1cb1bb649161bb266e
Opcode Fuzzy Hash: 17427babc41ff9092b115a15824281f35fa557e93686889dac9d9ee095f62d98
Instruction Fuzzy Hash: 25F0A731615321A793529F14FD0DA6E7674AB45B61B48843BFC04A71D0C7B1DC21CB54

Function 002219E2 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002219E7

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bd1369f238ac1a85e0930c9b87835f4a68c9269f605ae3feae45e9f5b4e53e07
Instruction ID: 0021e21e0203012b9705cfd8386570b8de719f45fd8e090000237670c4876e63
Opcode Fuzzy Hash: bd1369f238ac1a85e0930c9b87835f4a68c9269f605ae3feae45e9f5b4e53e07
Instruction Fuzzy Hash: 73B1E170A20666BFEB28CFF8D444EB9FBB1BF25304F14425AE45597281CB31A970CB91

Function 002281ED Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002281F2

Part of subcall function 002213AF: __EH_prolog.LIBCMT ref: 002213B4
Part of subcall function 002213AF: new.LIBCMT ref: 0022142C

Part of subcall function 002219E2: __EH_prolog.LIBCMT ref: 002219E7

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9f7c47f311569ae61b869fe198705ca0add2443841a01f07d0a5c4e48f566352
Instruction ID: 5673ce69fd99c2a36900747a481ef347a49cacbc530b9acd9bea892a4df9d8cd
Opcode Fuzzy Hash: 9f7c47f311569ae61b869fe198705ca0add2443841a01f07d0a5c4e48f566352
Instruction Fuzzy Hash: B841C772861674AEDB24DBA0E851BEA73A9AF50700F0400EAE44A93053DF745FE8DF50

Function 002321E5 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002321EA

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0989d3065e66b28833e27285212b64282e8c32fece76a7c23a4b7851523638c2
Instruction ID: 88b3102d6f26e6bc24f3506d170a965b25ccf55dc3c083262669c0ec76965ec9
Opcode Fuzzy Hash: 0989d3065e66b28833e27285212b64282e8c32fece76a7c23a4b7851523638c2
Instruction Fuzzy Hash: FC21FBF1E60216AFDB14DFB9DC41B6B7668FB08714F00053AE905EB681D7749D24CBA8

Function 00239484 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00239489

Part of subcall function 002213AF: __EH_prolog.LIBCMT ref: 002213B4
Part of subcall function 002213AF: new.LIBCMT ref: 0022142C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9e3b126728d596bc51c286bd9428389faaa0be504aed13e1c30f23d1d2fc2184
Instruction ID: 945105413ccf28264ef521a55f3a9fd1e8b2d0ad6ebab21f32cfaf363f164b29
Opcode Fuzzy Hash: 9e3b126728d596bc51c286bd9428389faaa0be504aed13e1c30f23d1d2fc2184
Instruction Fuzzy Hash: 4C216BB1C14259AFCF15DF94D9819EEB7B4EF29300F5000AAE809B3202D775AE65CF60

Function 00229120 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00229125

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 412da2c4a248c9d8049d6f742ded108c4d994e41df2977ce55f040c8f25829b5
Instruction ID: 05089dbd6abfda34d762b99e6985c65bb588acc5851c50beafc08de8932d9320
Opcode Fuzzy Hash: 412da2c4a248c9d8049d6f742ded108c4d994e41df2977ce55f040c8f25829b5
Instruction Fuzzy Hash: 00115172D2053A6BCB16AFD8E8519DEB735AF88740F114125F80567211CA348D708A90

Function 0022A6F9 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 0022A70B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e95ee28532b51306dce8df1ac8ba5749f961c6c7f7d8ca424c4966959d876736
Instruction ID: 2647045f3c50851447f1070b47c3a62384fba6f62abe5f8a8f443fe2cde93278
Opcode Fuzzy Hash: e95ee28532b51306dce8df1ac8ba5749f961c6c7f7d8ca424c4966959d876736
Instruction Fuzzy Hash: F9F0A430930726AFCB709EA4E84571AB7F4EB15360F20892EE495C7980E7B0D8A08746

Function 002459EC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0024239A,?,0000015D,?,?,?,?,00242F19,000000FF,00000000,?,?), ref: 00245A1E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fd711b93ddba779cf33fccfa1d080abe4231d94e0ae4cdf36c64b8b6996b72ab
Instruction ID: 78a98e378c1ce751d5a866b5d7b100cb0547515f9fc869a94910b82a43369e4f
Opcode Fuzzy Hash: fd711b93ddba779cf33fccfa1d080abe4231d94e0ae4cdf36c64b8b6996b72ab
Instruction Fuzzy Hash: 96E02B31131E325BE7392F61AC85B9A374CDF053B1F110324BCC59A193EBA0CD2089A5

Function 00225B05 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00225B0A

Part of subcall function 0022ACB6: __EH_prolog.LIBCMT ref: 0022ACBB

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0071cf754fc767f325eefc53440332039a8497f07e35142b87997e260ee57bb1
Instruction ID: 7ef6141e09ec4693bd1ab3c1fb02d7785d3f28d11055a97f14ef24dc8141c54d
Opcode Fuzzy Hash: 0071cf754fc767f325eefc53440332039a8497f07e35142b87997e260ee57bb1
Instruction Fuzzy Hash: 9401A230920769EAC714E7E4E5153DDF7F49F15300F4080AEA85923342CFB41B28CBA2

Function 0022A195 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0022A1C4

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 156bb2d8522aa4d6c6f9f65bf6da6c0cecdfb757d386f1630bb54c3b87baf4d8
Instruction ID: d7778065316cafd4975d028dc157fd35652d7f672cf7236cd7fa9d7a2be1e051
Opcode Fuzzy Hash: 156bb2d8522aa4d6c6f9f65bf6da6c0cecdfb757d386f1630bb54c3b87baf4d8
Instruction Fuzzy Hash: 9BF0BE314297A0FBCA225BF4A804BCABB916F16331F008A4AF0FD021D2C27514F99B22

Function 00221EBF Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00221EC4

Part of subcall function 00221927: __EH_prolog.LIBCMT ref: 0022192C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5dfd057b95b3a5b93c58eeb71e0b093054c3e5e4b25a37a63ac1cd5efab36c7d
Instruction ID: c4f89cce08b247fd946c406cda070db028bbb1d1016c497a64fc9e2da06a6728
Opcode Fuzzy Hash: 5dfd057b95b3a5b93c58eeb71e0b093054c3e5e4b25a37a63ac1cd5efab36c7d
Instruction Fuzzy Hash: 69F01CB1C102599ECF45DFE8D505AEEBBF4BB29300F0401BED419F3202EB3546248B91

Function 00221EC4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00221EC4

Part of subcall function 00221927: __EH_prolog.LIBCMT ref: 0022192C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9174b26c55bc6689883bf4742441a397630375c3705d662e38516824eb19a35e
Instruction ID: 4c1e57544d559bfed291d9676ae9975e2202d5b61a56f66d73e92f4e59d7cd1e
Opcode Fuzzy Hash: 9174b26c55bc6689883bf4742441a397630375c3705d662e38516824eb19a35e
Instruction Fuzzy Hash: DAF015B1C102589ECF40DFE8D506AEEBBF0BB29300F0401BED409F3202EB3546248B90

Function 0022F944 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0022F979

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: aaf25a25c921c1417b4cf8c6659ef154513f11a88163020b866d1625ba56c82e
Instruction ID: 1511f521c11428d8badc46c37462c9187e7e48f79158cf6d726af645bb4536f7
Opcode Fuzzy Hash: aaf25a25c921c1417b4cf8c6659ef154513f11a88163020b866d1625ba56c82e
Instruction Fuzzy Hash: 63D0C291B3026136DA5137A8394EBFD151A0FC1716F0C0035B445671828A6508A25E72

Function 00238B64 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00238B6A

Part of subcall function 00238923: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00238944

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: b3ecc342144db532c8dedf8b776bc33c6e15ccf428a3dce563ad8a90b77a80c7
Instruction ID: d4de1a0d0cd869e814393a5393286bfe039e8e25895509bb321fc174458eb863
Opcode Fuzzy Hash: b3ecc342144db532c8dedf8b776bc33c6e15ccf428a3dce563ad8a90b77a80c7
Instruction Fuzzy Hash: 86D0A7F023030E7BDF416F608C02A7DBA99EB41350F008135BC04D9250FE71CD30A652

Function 0022976A Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,0022969C), ref: 00229776

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b7f692df4d72d18034112944487b4af787e911132d8ba4d3e4cd1676e7eec8a4
Instruction ID: a2cbb0dfd0daba9969c0d313f3f9d1121dcbb1f2f7e21d189f0b1cfda059ed19
Opcode Fuzzy Hash: b7f692df4d72d18034112944487b4af787e911132d8ba4d3e4cd1676e7eec8a4
Instruction Fuzzy Hash: 96D012B0071211758E610F74BD4D0A5A651AB833A7F68CAE4E025C40B1C732C8A3F540

Function 0023BF76 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0023BF9B

Part of subcall function 0023991D: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0023992E
Part of subcall function 0023991D: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0023993F
Part of subcall function 0023991D: TranslateMessage.USER32(?), ref: 00239949
Part of subcall function 0023991D: DispatchMessageW.USER32(?), ref: 00239953

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 6dca87b8d10641692e781b4f3bc4214ad10135ff19fab10fbd83f339c3ecc57c
Instruction ID: f8d4ed63f1f1b5938cddfae4c169ef95f116b56e6ad59515ea2e0563ad854178
Opcode Fuzzy Hash: 6dca87b8d10641692e781b4f3bc4214ad10135ff19fab10fbd83f339c3ecc57c
Instruction Fuzzy Hash: 91D09E72158300BADA012B51DD06F0A7AA3BB99B05F404554B644340B186A29D31EF06

Function 0023CD5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023CD6D

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 942997a391e48b0ae523d3b18f0c313e7106ede566f102d5afb9c18189ec16e9
Instruction ID: fc073f868b44fbbf41f10309365b22567abbf8b4215b648a6bea6043b4e22019
Opcode Fuzzy Hash: 942997a391e48b0ae523d3b18f0c313e7106ede566f102d5afb9c18189ec16e9
Instruction Fuzzy Hash: 5EB092D1278004BD2114A2286A0A8360118C080F12770816AB802B0040A890487A4136

Function 0023C725 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 424c2564da90974f9426265e20b8fe74eca217ab23b2914ae24badf3077fb99d
Instruction ID: b56a583d6cd5413df5a3e85e0d9f8e5e910812fa20d02d84bf0b4ed44323e37f
Opcode Fuzzy Hash: 424c2564da90974f9426265e20b8fe74eca217ab23b2914ae24badf3077fb99d
Instruction Fuzzy Hash: 88B012F12786017C3104A1042D47C36051CC0C5F22B30821BFC00F0144DCD00C7E4A36

Function 0023C740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6eab3007a99ce6e9150bd4762069969691fd67d7d7b2c26bbc1fbc751df545ee
Instruction ID: 1fac4420376b05cc5633d58a83f5b6abc26e3e6494da7ab789670fb2ee45fc19
Opcode Fuzzy Hash: 6eab3007a99ce6e9150bd4762069969691fd67d7d7b2c26bbc1fbc751df545ee
Instruction Fuzzy Hash: 41B012F12784017C3104E1046D07C3B015CC0C1F12B30821BFC05E0140DCD00C3E063A

Function 0023C74A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 391ea24abf3d84deb4de778c8d12cb50cd0cd209d07bd100e8eb2a4420d4df81
Instruction ID: 6fa18ecdb85094b354f5ee4fdfb1948f7438d2418ba8e3ad09ebd77a4ef10ef3
Opcode Fuzzy Hash: 391ea24abf3d84deb4de778c8d12cb50cd0cd209d07bd100e8eb2a4420d4df81
Instruction Fuzzy Hash: 1EB012F12785017C3104E5082D07C36015CC0C1F12B30C11BFC04E1240DCD00C3E0A36

Function 0023C75E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 56ad7a34e4facd33c79ba9aabc95f36f075fc8b7bd75dcf76266ace29b17e63b
Instruction ID: be46e1f34e7b3a1297918b6a62d8a1d8e241b14d39a8b4b9a83fea8ed56ed05a
Opcode Fuzzy Hash: 56ad7a34e4facd33c79ba9aabc95f36f075fc8b7bd75dcf76266ace29b17e63b
Instruction Fuzzy Hash: 59B092E12786016D2104A1182E06836015CC081B12B30811ABD05E1240D8900C2A0A36

Function 0023C7B5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C798

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7ebce0977fbf00355e6bfe5672d0648e8f71516d1e49f75102fc1d9da4e60ac7
Instruction ID: 284ada5dcbaca04728b7fad4b5d5044a40c846ef8797d0d2700b2d0965bd4436
Opcode Fuzzy Hash: 7ebce0977fbf00355e6bfe5672d0648e8f71516d1e49f75102fc1d9da4e60ac7
Instruction Fuzzy Hash: 48B012E22781046C3108D14A2C07C36015CC1C9F12B30C11BFC04E1140DCD00C39073E

Function 0023C7BF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C798

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9d9cff1aa113928ddb8b5bce8d0031417ca67dbab99a7c539936d83775f712f9
Instruction ID: ab7460b39369908af04c86c8cb0db8765374fb78cd3b32941d26d2ef6d6dddd1
Opcode Fuzzy Hash: 9d9cff1aa113928ddb8b5bce8d0031417ca67dbab99a7c539936d83775f712f9
Instruction Fuzzy Hash: 4CB092E22780006C210891452906836015DC189B12B30811ABC04E1140A8900C2E063A

Function 0023C786 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C798

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e48d8e117de5fd9c7aaae38af7fa7f75773b583286fc27a898c6fb4e3dfab0e6
Instruction ID: 62e797f30c13358717679c4fae38bccc951cbd0aedcfbf34b20f2f70569e55ac
Opcode Fuzzy Hash: e48d8e117de5fd9c7aaae38af7fa7f75773b583286fc27a898c6fb4e3dfab0e6
Instruction Fuzzy Hash: 15B012F22791007C3108D1412C07C36011DC1CAF12B30C11BFC04F0040ACD01C3D053E

Function 0023C76D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 38b176ad57136052b983d0101ee070a6755ef93267bdfdc57899d835648aafe4
Instruction ID: 2d0f0f47b3f01495f03c88b6ef93b0153dee2542f483c10c266158de0919d3b7
Opcode Fuzzy Hash: 38b176ad57136052b983d0101ee070a6755ef93267bdfdc57899d835648aafe4
Instruction Fuzzy Hash: EEA001F62B9956BC3108A6516D0AC3A465CC4C6FA2B30891AFD06E4185ADD0186A1A35

Function 0023C777 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4edca0d1591fbe7180de88156cee58ed3d6d220cf67e7ea32ada13c9e7424ef0
Instruction ID: 2d0f0f47b3f01495f03c88b6ef93b0153dee2542f483c10c266158de0919d3b7
Opcode Fuzzy Hash: 4edca0d1591fbe7180de88156cee58ed3d6d220cf67e7ea32ada13c9e7424ef0
Instruction Fuzzy Hash: EEA001F62B9956BC3108A6516D0AC3A465CC4C6FA2B30891AFD06E4185ADD0186A1A35

Function 0023C759 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0a2ba6b94faec89a0f793f2266e74ae8cdbc19d1174ee723d86407b12824724a
Instruction ID: 2d0f0f47b3f01495f03c88b6ef93b0153dee2542f483c10c266158de0919d3b7
Opcode Fuzzy Hash: 0a2ba6b94faec89a0f793f2266e74ae8cdbc19d1174ee723d86407b12824724a
Instruction Fuzzy Hash: EEA001F62B9956BC3108A6516D0AC3A465CC4C6FA2B30891AFD06E4185ADD0186A1A35

Function 0023C7A6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C798

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c5413c02b169c547fa3d70460964cd4d3a91d4b2147936fb00cfe1d1c35fa079
Instruction ID: 74160f56a31d0235ba4f87ff54b9e0b0cd9609bedaf8aa758770fb251d7b30aa
Opcode Fuzzy Hash: c5413c02b169c547fa3d70460964cd4d3a91d4b2147936fb00cfe1d1c35fa079
Instruction Fuzzy Hash: 2AA001E62B9546BC3108A6926D0AC3A466CC4CAF62B30891AFC06E4181ADD0186A1A39

Function 0023C7B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C798

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 89682785d4f4c021af0e6b7ae8a3669884f56763406c2e97b4838a3844bd2b18
Instruction ID: 74160f56a31d0235ba4f87ff54b9e0b0cd9609bedaf8aa758770fb251d7b30aa
Opcode Fuzzy Hash: 89682785d4f4c021af0e6b7ae8a3669884f56763406c2e97b4838a3844bd2b18
Instruction Fuzzy Hash: 2AA001E62B9546BC3108A6926D0AC3A466CC4CAF62B30891AFC06E4181ADD0186A1A39

Function 0023C781 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0023C737

Part of subcall function 0023CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0023CB38
Part of subcall function 0023CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0023CB49

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9e02ad7a86bec9434794483f2a19f01c9ddbfcfd40245e1ef380370e9d861e7d
Instruction ID: 2d0f0f47b3f01495f03c88b6ef93b0153dee2542f483c10c266158de0919d3b7
Opcode Fuzzy Hash: 9e02ad7a86bec9434794483f2a19f01c9ddbfcfd40245e1ef380370e9d861e7d
Instruction Fuzzy Hash: EEA001F62B9956BC3108A6516D0AC3A465CC4C6FA2B30891AFD06E4185ADD0186A1A35

Function 00239022 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00239279,00262120,00000000,00263122,00000006), ref: 00239026

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 289bc2234c4d94cbc79291775c08ab498e728be22461d258444f5aa31ca045b4
Instruction ID: f48b47392f9c5213bc8b4fef9a5d16683ac9c827c23a038fa4b56ea0c0b9b835
Opcode Fuzzy Hash: 289bc2234c4d94cbc79291775c08ab498e728be22461d258444f5aa31ca045b4
Instruction Fuzzy Hash: 68A012301A420646CE000B30DC0DC1576505760703F00C6207006C00A0CF308810E505

Function 002294F3 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,002294C3), ref: 0022950E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 36fe7acb7a88b0b011321565c6f62b1fcf1f5b80f022353c2bfbb03003c6bd92
Instruction ID: e6e87a8b239e5a3bbb20e0b984d0deded5bb765b894042f9a87e0413bec9ab33
Opcode Fuzzy Hash: 36fe7acb7a88b0b011321565c6f62b1fcf1f5b80f022353c2bfbb03003c6bd92
Instruction Fuzzy Hash: ABF0B470662B256EDB318E64E548792B3E45B11721F444B1E84E6474E0937168F88F10

Non-executed Functions

Function 0023A536 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002212E7: GetDlgItem.USER32(00000000,00003021), ref: 0022132B
Part of subcall function 002212E7: SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0023A5C7
EndDialog.USER32(?,00000006), ref: 0023A5DA
GetDlgItem.USER32(?,0000006C), ref: 0023A5F6
SetFocus.USER32(00000000), ref: 0023A5FD
SetDlgItemTextW.USER32(?,00000065,?), ref: 0023A63D
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0023A670
FindFirstFileW.KERNEL32(?,?), ref: 0023A686
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0023A6A4
FileTimeToSystemTime.KERNEL32(?,?), ref: 0023A6B4
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0023A6D1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0023A6EF

Part of subcall function 0022D192: LoadStringW.USER32(?,?,00000200,?), ref: 0022D1D7
Part of subcall function 0022D192: LoadStringW.USER32(?,?,00000200,?), ref: 0022D1ED

_swprintf.LIBCMT ref: 0023A71F

Part of subcall function 00223F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00223F3E

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0023A732
FindClose.KERNEL32(00000000), ref: 0023A735
_swprintf.LIBCMT ref: 0023A790
SetDlgItemTextW.USER32(?,00000068,?), ref: 0023A7A3
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0023A7B9
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0023A7D9
FileTimeToSystemTime.KERNEL32(?,?), ref: 0023A7E9
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0023A803
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0023A81B
_swprintf.LIBCMT ref: 0023A84C
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0023A85F
_swprintf.LIBCMT ref: 0023A8AF
SetDlgItemTextW.USER32(?,00000069,?), ref: 0023A8C2

Part of subcall function 0023932E: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00239354
Part of subcall function 0023932E: GetNumberFormatW.KERNEL32(00000400,00000000,?,0025A154,?,?), ref: 002393A3

Strings

%s %s %s, xrefs: 0023A70D, 0023A839
%s %s, xrefs: 0023A77E, 0023A8A1
REPLACEFILEDLG, xrefs: 0023A55D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3227067027-1840816070
Opcode ID: 7c7319e3e0a8cc55caf96d28d67b9124088e88b217b643b48a359b6d10590ad5
Instruction ID: 6891b3791d7b317cbf48125bd7e07383a3792242cddedd190236b941b6abb90e
Opcode Fuzzy Hash: 7c7319e3e0a8cc55caf96d28d67b9124088e88b217b643b48a359b6d10590ad5
Instruction Fuzzy Hash: DF91D7B2558309BFD231DBA0DD89FFB77ACEB49701F404829F689D2080D775AA148B63

Function 00227070 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00227075
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 002271D5
CloseHandle.KERNEL32(00000000), ref: 002271E5

Part of subcall function 00227A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00227AAC
Part of subcall function 00227A9D: GetLastError.KERNEL32 ref: 00227AF2
Part of subcall function 00227A9D: CloseHandle.KERNEL32(?), ref: 00227B01

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 002271F0
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 002272FE
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 0022732A
CloseHandle.KERNEL32(?), ref: 0022733C
GetLastError.KERNEL32(00000015,00000000,?), ref: 0022734C
RemoveDirectoryW.KERNEL32(?), ref: 00227398
DeleteFileW.KERNEL32(?), ref: 002273C0

Strings

SeRestorePrivilege, xrefs: 00227096
UNC\, xrefs: 00227120
\??\, xrefs: 002270FB
SeCreateSymbolicLinkPrivilege, xrefs: 002270A0

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 3e6ccb51d43a8abf1541cf256b9ccaed707f84cda9355264631ead122fa63c73
Instruction ID: 6c10014716135add800f6a69baf9b84f7702df4698bc1c585df24dd9446dfac3
Opcode Fuzzy Hash: 3e6ccb51d43a8abf1541cf256b9ccaed707f84cda9355264631ead122fa63c73
Instruction Fuzzy Hash: 7DB1D471924225AFDB20DFA4EC85BEE77B8AF08300F1045A9FD19E7141D730AA64CF61

Function 002231F0 Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 604COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 002231F9
_memcmp.LIBVCRUNTIME ref: 002232DC

Strings

hc%u, xrefs: 002235DC
CMT, xrefs: 002238F1
h%u, xrefs: 0022358E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: 11ea1c291b833bd5be2f449eaa79089cf8482e71e8d2705a88510458dfdb8aab
Instruction ID: a452ff9288241a1a7506599ba16e399b0599be2b3bdd7694f2e5781243b9a3a8
Opcode Fuzzy Hash: 11ea1c291b833bd5be2f449eaa79089cf8482e71e8d2705a88510458dfdb8aab
Instruction Fuzzy Hash: 8C32C271520394AFDF14DFA4D886AEA37A5AF55300F04447EFD4A8F282DB749A68CF60

Function 0024A350 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0024A496

Strings

1#INF, xrefs: 0024B6A3
1#SNAN, xrefs: 0024B695
1#IND, xrefs: 0024B68E
1#QNAN, xrefs: 0024B69C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a46640b39147d2734ec8a76d67580700aef800d480b5b2a89e1e448844873a6f
Instruction ID: 53f9061c5e58d5a61c587465ab8b1fe13f1cba1291ff25f8b16946b5036fd686
Opcode Fuzzy Hash: a46640b39147d2734ec8a76d67580700aef800d480b5b2a89e1e448844873a6f
Instruction Fuzzy Hash: 04C25E71E246298FDB29CF28DD407EAB7B9EB44305F1541EAD80EE7240E774AE918F41

Function 00222759 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 793COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00222762
_strlen.LIBCMT ref: 00222CEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00222E43

Strings

CMT, xrefs: 00222E76

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: H_prologUnothrow_t@std@@@__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 3741668355-2756464174
Opcode ID: b40c8bad90acc611d1f25aa7a6474a38a4483d705b9008037fb0791fadd6f0a7
Instruction ID: e1b2bc8357ac388e64578e9d83809387cc805e336cd84d7be535fd2a61492268
Opcode Fuzzy Hash: b40c8bad90acc611d1f25aa7a6474a38a4483d705b9008037fb0791fadd6f0a7
Instruction Fuzzy Hash: 92622671520255EFCF18DFB4D8857EA3BE1AF14304F05457EEC8A9B282DB759968CB20

Function 00245B43 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00245C3B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00245C45
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 00245C52

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 469a738f9b2ed589712eba7d03940c437478c6e333ba1ca8d72aa3b4996478f9
Instruction ID: 2a38ec89a8ccb5428c98bb1d223ebbde58b9f373d11c6638b12a29885213fadb
Opcode Fuzzy Hash: 469a738f9b2ed589712eba7d03940c437478c6e333ba1ca8d72aa3b4996478f9
Instruction Fuzzy Hash: B231C6749113299BCB21DF64DC8979DBBB4BF08711F5041EAE80CA7251EB709F918F45

Function 00247D69 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00247EFC

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 41b14542c4fd97629875860bbf6b1fdb9f6c7cef568e2632a0f4e795bfaef87e
Instruction ID: 03aad213f22083e46e996ce20a55f8a92cb7533380e44001fb12d7c7c8eee3b7
Opcode Fuzzy Hash: 41b14542c4fd97629875860bbf6b1fdb9f6c7cef568e2632a0f4e795bfaef87e
Instruction Fuzzy Hash: 2C31387192421AAFCB289E78CC84EFB7BBDDF85304F1002A8F929D7252E7309D558B50

Function 00249EA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8cca871330e4123537bb6ab64568d03676673747229a1061e8821d119ab4a2
Instruction ID: 5d5278cd8a2734eec07fc6dad7f6b9eed9c766c3bc67f9248ce634138916868b
Opcode Fuzzy Hash: 1d8cca871330e4123537bb6ab64568d03676673747229a1061e8821d119ab4a2
Instruction Fuzzy Hash: C9024D71E502199FDF18CFA9C8806AEBBF1FF88314F258169D919E7284D731AD518B81

Function 0023932E Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00239354
GetNumberFormatW.KERNEL32(00000400,00000000,?,0025A154,?,?), ref: 002393A3

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 10cac912fa967dd1691249b6bd33193959b9d1da5df59b9f998bc7a941391156
Instruction ID: 5b1ec772b625e1fcd315aedeec2caeac8c533661892cbd9776a99ddda41c2435
Opcode Fuzzy Hash: 10cac912fa967dd1691249b6bd33193959b9d1da5df59b9f998bc7a941391156
Instruction Fuzzy Hash: DF019E75110359BADB10CFA4ED49FAB77BCEF09311F008522BB08D72A0E3709924CBA6

Function 0024E8D4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0024E8CF,?,?,00000008,?,?,0024E56F,00000000), ref: 0024EB01

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 821c378a232839ca46472b0f581e9c8d67b3bd29450d752126478468df8f4266
Instruction ID: a1e67e24476bc0e263b6bc7cb6ff4b155d915146ccad9baaeb24fb6d03bf7ef2
Opcode Fuzzy Hash: 821c378a232839ca46472b0f581e9c8d67b3bd29450d752126478468df8f4266
Instruction Fuzzy Hash: 7FB13F31520609DFEB19CF28C486B657BE0FF45365F268658E8DACF2A1C375E9A1CB40

Function 00223F95 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

gj, xrefs: 00223FD8

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 3b8f0b1deaf2e9a2ced38aa994824f337de3fc662b6e5a9345091faa3549d5c1
Instruction ID: 3ea2d6b8400e0800ce8ab437d0824d69a767652d20f2814198f2c312724614cf
Opcode Fuzzy Hash: 3b8f0b1deaf2e9a2ced38aa994824f337de3fc662b6e5a9345091faa3549d5c1
Instruction Fuzzy Hash: 06F1C2B2A083418FD748CF29D880A1AFBE1BFC8308F19896EF598D7711D734E9558B56

Function 0022A930 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0022A955

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 86608aabb941a857e65647ab923b7b92a97a80b58e84b71c9b7d0fdb4c36feac
Instruction ID: 6969315dc7ab8ab8a8365026af72e70c0b1d7f392f1e9f84b53a7bbaa703e27b
Opcode Fuzzy Hash: 86608aabb941a857e65647ab923b7b92a97a80b58e84b71c9b7d0fdb4c36feac
Instruction Fuzzy Hash: 3AF06DB0D203198FCB28CF58FC8A6E973A5FB49315F200294D91553390E2719DC08E5A

Function 0023DB63 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001DB6F,0023D5E4), ref: 0023DB68

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 37d4f481a24b69881864c7a763da4b456187a47e7d3089965f84696dc2388f37
Instruction ID: 0fa26f3b14df6631fb33f5aca3d959db9fa1bc70e940d2c2ae9d3078b925cb2d
Opcode Fuzzy Hash: 37d4f481a24b69881864c7a763da4b456187a47e7d3089965f84696dc2388f37
Instruction Fuzzy Hash:

Function 0022DC32 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

8%, xrefs: 0022DCB4

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: 8%
API String ID: 0-218294443
Opcode ID: e5d128f1b6e94d1d743f4bcef3a9ed20da49faceca7bdfbbfb85825205c2bb88
Instruction ID: 593c1134daeba298a95edd16afe29e14e1f91e29b4b097c8fa69fb338b362534
Opcode Fuzzy Hash: e5d128f1b6e94d1d743f4bcef3a9ed20da49faceca7bdfbbfb85825205c2bb88
Instruction Fuzzy Hash: BF5103325183A66FC712CF68D1804AEBFF1AFDA314F4A489EE4D54B252C230D699CF52

Function 00248A9B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00248A9B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4833d7f0a2db39c8e2fb82d72258511e912220353278893e22cb61147f496cae
Instruction ID: bd3851fb02fdf49cb50665a5db4ef2d09c2409db425a320f842b75a21f97a529
Opcode Fuzzy Hash: 4833d7f0a2db39c8e2fb82d72258511e912220353278893e22cb61147f496cae
Instruction Fuzzy Hash: 53A001706026019BA7518F36BE4E3093AA9AA4A7A671590A9A80DC6260EB3485909A0A

Function 00234FB4 Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289fefe8c5a67303e04c4f7979b92612d24f26a9e9caf40240c5c4cc4755c92c
Instruction ID: cfeaa2625103984cca7c6ed05690638e14f4f83c46aba18eb0c3d0526d072b08
Opcode Fuzzy Hash: 289fefe8c5a67303e04c4f7979b92612d24f26a9e9caf40240c5c4cc4755c92c
Instruction Fuzzy Hash: 3D6218B1624B959FCB29DF38C8906B9BBE1AF55304F08856DD8DF8B346D230E965CB10

Function 002363F1 Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7df07331dc8246d27593e118a7ee815c0dd8300ee0f02b9d281ebf78cfae13a
Instruction ID: d3f558edf6205a97bcd1f13833d39037426a95a8bbe31c58a0f77aaac8d39465
Opcode Fuzzy Hash: a7df07331dc8246d27593e118a7ee815c0dd8300ee0f02b9d281ebf78cfae13a
Instruction Fuzzy Hash: 566224B062474AAFC719CF28C8846B9FBE5FB45308F14C66ED99687742D730E969CB40

Function 0022E097 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd2caf385a59822b9a14fbc93f7aaa4fbbe767d050e2cf75e0f52348a67b4f0
Instruction ID: 721bed20e3bb5d63c2fb64f7d9cfc9023edc337372bab7e16846bfb314a0f506
Opcode Fuzzy Hash: 4dd2caf385a59822b9a14fbc93f7aaa4fbbe767d050e2cf75e0f52348a67b4f0
Instruction Fuzzy Hash: C25249B26147019FC758CF19C891A6AF7E1FFC8304F8A892DF5869B255D334E919CB82

Function 00235DB8 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c690d1f42ddde34193b822b417f4b7bb99401d4b955e4ea9af1c22e8224f298
Instruction ID: 4de1d49c526e465a813bcb4e3e7ffee18d2edb7385d9a4db806499433dff0444
Opcode Fuzzy Hash: 5c690d1f42ddde34193b822b417f4b7bb99401d4b955e4ea9af1c22e8224f298
Instruction Fuzzy Hash: 0412E4F1620B069BC728DF28C894779B3E4FB44308F10892DE99BC7A81D374A8A5CB45

Function 0022BA6A Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292576d89c0934d0e65749edb6c389f3575b9b2f0939abd14752bce88f2b13e6
Instruction ID: ccd248fc721f796975076b22c3152270d197c5b6c8e86d40ce86aac0bc17c49c
Opcode Fuzzy Hash: 292576d89c0934d0e65749edb6c389f3575b9b2f0939abd14752bce88f2b13e6
Instruction Fuzzy Hash: 7DF1D971628362AFC31ACF69D58466ABBE6FFC8314F144A2EF49587351C730E9258F42

Function 0023F635 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 4ff1d1ceca680b714fe75ea7308719851add9b48b2a7310dc70212508c8972d8
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 64C1C5B262529349DB9D4A3DEA3413EFAA05EA27B1B1A037DD4F6CB1D4EE20C534C610

Function 0023FA6A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 315d32ba7b81e1e29fa13668faccfa776cad74cf6346ddd5bcab05c89c959e94
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: A4C1D8B262529349DF9D4A3DEA3403EFAA16AA27B171B077DD4F6CB0D4EE20C534D610

Function 0023F200 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: e3e54a1e6d124202961befacf075ec9510ad7342a4e009dbbe52ea831bbcaafa
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 88C1C7B262529349DF9D4A3DEA3403FBAA05AA27B171A037DD8F7CB0D4EE20C534D610

Function 0023EDE8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a771c864fb73bffb25572ef4da6306dab43bc9cf0268d886de4ddc70b28adc67
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 37C1D8B262529349DF5D4A3DEA3403EBAA16AA27B171B077DD4F6CB1C4EE20C538D610

Function 0022D634 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e631e4fa23e3c8f33370c22e3c85ab0fc7558225e8bd501687fd53c5dcff33ca
Instruction ID: 103e4a1c6f5dfd74dd954b7a357b465acf4218b646caa2432c6bf79d9e865b96
Opcode Fuzzy Hash: e631e4fa23e3c8f33370c22e3c85ab0fc7558225e8bd501687fd53c5dcff33ca
Instruction Fuzzy Hash: 07E166755193908FC344CF69E89086BBBF0AFCA300F49499EF9C597362C274EA15DB62

Function 00232DB4 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f2a4d6ddd3b585317645cc5051d726e6ea8aecf25b64319d1df32cbac21ee2
Instruction ID: 367c877650763fa8f4463a22546a583abca19116517470cbc437873e77fc97af
Opcode Fuzzy Hash: 27f2a4d6ddd3b585317645cc5051d726e6ea8aecf25b64319d1df32cbac21ee2
Instruction Fuzzy Hash: E7917DF1224306DBD728EF64D8D5BBE73D5AB50300F10092DE59BC7682DAB4E668CB52

Function 00242B68 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54df74966c104d7672ade8818cbfe8865ba91336dc4c8812e09e5b37c5f9e5c
Instruction ID: 0a9fb3c51ee5e5d40b6c02c601f865d344b3431fd59b33a302f7d28fe635b03f
Opcode Fuzzy Hash: b54df74966c104d7672ade8818cbfe8865ba91336dc4c8812e09e5b37c5f9e5c
Instruction Fuzzy Hash: 3A619C71A3070AE2DA3C9E2BC9D57BE6384EB01704FD0091AF843DB281D6919D7E8B55

Function 002330E5 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00179462e72e715994715ee1dba655cee4073e68508d321703d4c828cdcba7bf
Instruction ID: bdfb647a82a24e8a5260b5c506e6885bb3ea0bb00c28ebfb90cbc16e55817ee2
Opcode Fuzzy Hash: 00179462e72e715994715ee1dba655cee4073e68508d321703d4c828cdcba7bf
Instruction Fuzzy Hash: 02715EF17343465BDB24DE68C8C4BAE77D5AB90304F00496DE9CACB282CA74CB98C752

Function 0022D222 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8995d95ba31cb68ecd67f508875119d850bbab8cf1e2c7b06167800722185fd
Instruction ID: 0104134ba42e6e134cfb38010da107adfbd8be6ff4e5b8583550ffdbf9faa0d0
Opcode Fuzzy Hash: e8995d95ba31cb68ecd67f508875119d850bbab8cf1e2c7b06167800722185fd
Instruction Fuzzy Hash: 4B81D5911292E0ADC7468F7D38E91F93EA15777341F1D84FAC8C5C62B3C0768A68E721

Function 0022ECE9 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c727befb3c4882ad100ced8855fc6fb33e0ca2d8967eb5b04da9fc7556d8f5d4
Instruction ID: 656b8caa2b52f4da4d2251aab599b70ba6001482d65f58124dc3f37c3f8d5d41
Opcode Fuzzy Hash: c727befb3c4882ad100ced8855fc6fb33e0ca2d8967eb5b04da9fc7556d8f5d4
Instruction Fuzzy Hash: AB512671A083129FC748CF19E49059AF7E1FF88314F054A2EE899A7740DB34E959CBDA

Function 00232B39 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d8200d211fb2155360bb18f1da6528e951efe338ec765a37701bdcb59cc893
Instruction ID: faa062bddd73362745ea997f0cea37e4b7073acf8669be32e70c4f1eea97f38d
Opcode Fuzzy Hash: 03d8200d211fb2155360bb18f1da6528e951efe338ec765a37701bdcb59cc893
Instruction Fuzzy Hash: 7E3124B162431A9FCB14EF28D85126EFBD1FB95304F00492DE88AD7741C678E919CF92

Function 00225E83 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a08a63780973e12e01ec173dbae7b2df660e0d068e0af751bcafa189aa01330
Instruction ID: 19b159526ac526f220aead965ae53089386b79dacc65b437f23f2447df92ab63
Opcode Fuzzy Hash: 5a08a63780973e12e01ec173dbae7b2df660e0d068e0af751bcafa189aa01330
Instruction Fuzzy Hash: 0C21CB31A206356BC708CF6DFCA94367751A74A302786826BED428B291C535DD24CBE0

Function 0024957E Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 002495C2

Part of subcall function 0024915D: _free.LIBCMT ref: 0024917A
Part of subcall function 0024915D: _free.LIBCMT ref: 0024918C
Part of subcall function 0024915D: _free.LIBCMT ref: 0024919E
Part of subcall function 0024915D: _free.LIBCMT ref: 002491B0
Part of subcall function 0024915D: _free.LIBCMT ref: 002491C2
Part of subcall function 0024915D: _free.LIBCMT ref: 002491D4
Part of subcall function 0024915D: _free.LIBCMT ref: 002491E6
Part of subcall function 0024915D: _free.LIBCMT ref: 002491F8
Part of subcall function 0024915D: _free.LIBCMT ref: 0024920A
Part of subcall function 0024915D: _free.LIBCMT ref: 0024921C
Part of subcall function 0024915D: _free.LIBCMT ref: 0024922E
Part of subcall function 0024915D: _free.LIBCMT ref: 00249240
Part of subcall function 0024915D: _free.LIBCMT ref: 00249252

_free.LIBCMT ref: 002495B7

Part of subcall function 002459B2: RtlFreeHeap.NTDLL(00000000,00000000,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?), ref: 002459C8
Part of subcall function 002459B2: GetLastError.KERNEL32(?,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?,?), ref: 002459DA

_free.LIBCMT ref: 002495D9
_free.LIBCMT ref: 002495EE
_free.LIBCMT ref: 002495F9
_free.LIBCMT ref: 0024961B
_free.LIBCMT ref: 0024962E
_free.LIBCMT ref: 0024963C
_free.LIBCMT ref: 00249647
_free.LIBCMT ref: 0024967F
_free.LIBCMT ref: 00249686
_free.LIBCMT ref: 002496A3
_free.LIBCMT ref: 002496BB

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: becf0c207e1e3f84548f137d6d4892f699909ba0aad36a39312e0ceb62ad5c1d
Instruction ID: a518bd7c2a30f9ec3d2497499c35115841c540ef6e38839ce14bf86698c81958
Opcode Fuzzy Hash: becf0c207e1e3f84548f137d6d4892f699909ba0aad36a39312e0ceb62ad5c1d
Instruction Fuzzy Hash: 65313B31621A02DFEB2DAE79D845B5B73E8FF00320F214419E489D6252DA31ACE0CF54

Function 0023B8BB Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0023B8DC
GetClassNameW.USER32(00000000,?,00000800), ref: 0023B90B

Part of subcall function 00230B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0022AC99,?,?,?,0022AC48,?,-00000002,?,00000000,?), ref: 00230B16

GetWindowLongW.USER32(00000000,000000F0), ref: 0023B929
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0023B940
GetObjectW.GDI32(00000000,00000018,?), ref: 0023B953

Part of subcall function 00238B21: GetDC.USER32(00000000), ref: 00238B2D
Part of subcall function 00238B21: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00238B3C
Part of subcall function 00238B21: ReleaseDC.USER32(00000000,00000000), ref: 00238B4A

Part of subcall function 00238ADE: GetDC.USER32(00000000), ref: 00238AEA
Part of subcall function 00238ADE: GetDeviceCaps.GDI32(00000000,00000058), ref: 00238AF9
Part of subcall function 00238ADE: ReleaseDC.USER32(00000000,00000000), ref: 00238B07

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0023B97A
DeleteObject.GDI32(00000000), ref: 0023B981
GetWindow.USER32(00000000,00000002), ref: 0023B98A

Strings

STATIC, xrefs: 0023B911

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: f72cf85a212b5a27f775651ab5b2d6e08cd46da4513d58e3dc1bf7f64815fb58
Instruction ID: 23d70b8b7b8a299fd9fc1f28210df57e6282836773daf4462a43cdd422e2a4a4
Opcode Fuzzy Hash: f72cf85a212b5a27f775651ab5b2d6e08cd46da4513d58e3dc1bf7f64815fb58
Instruction Fuzzy Hash: CA21C3B25203257BEB226F64EC4AFAE776DAF05701F004111FB01A6091CF749E618ABA

Function 0024621A Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0024622E

Part of subcall function 002459B2: RtlFreeHeap.NTDLL(00000000,00000000,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?), ref: 002459C8
Part of subcall function 002459B2: GetLastError.KERNEL32(?,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?,?), ref: 002459DA

_free.LIBCMT ref: 0024623A
_free.LIBCMT ref: 00246245
_free.LIBCMT ref: 00246250
_free.LIBCMT ref: 0024625B
_free.LIBCMT ref: 00246266
_free.LIBCMT ref: 00246271
_free.LIBCMT ref: 0024627C
_free.LIBCMT ref: 00246287
_free.LIBCMT ref: 00246295

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7da4a09fa63c4e5c4a873ea1a52677acb32b72876bed4137efe57c64ab4e150d
Instruction ID: 58a3aa2e0182107a6d6ba41ab4354a014f2f95c5ce8dde576f5f3f015ee18019
Opcode Fuzzy Hash: 7da4a09fa63c4e5c4a873ea1a52677acb32b72876bed4137efe57c64ab4e150d
Instruction Fuzzy Hash: 2C116376521918EFDF09EF94C942CDD3BB5FF04360B5140A5BA898B222DA31DAA0DFC1

Function 002220D3 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

xc%u, xrefs: 00222648
x%u, xrefs: 002225EB
;%u, xrefs: 00222408

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: c6949c99ce01d32501671dde91cc208354833109f8dba3d690f29333b11a5480
Instruction ID: 43c4ab38df54dd87a418011763f1b7a5155b883c56a4a6c182d3b68bd9439a5c
Opcode Fuzzy Hash: c6949c99ce01d32501671dde91cc208354833109f8dba3d690f29333b11a5480
Instruction Fuzzy Hash: C9F15C716243A1FADB14EFE4A995BFE77995F90300F084568FC858F243CA65886CCB62

Function 0023995E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002212E7: GetDlgItem.USER32(00000000,00003021), ref: 0022132B
Part of subcall function 002212E7: SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

EndDialog.USER32(?,00000001), ref: 002399AE
SendMessageW.USER32(?,00000080,00000001,?), ref: 002399DB
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 002399F0
SetWindowTextW.USER32(?,?), ref: 00239A01
GetDlgItem.USER32(?,00000065), ref: 00239A0A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00239A1E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00239A30

Strings

LICENSEDLG, xrefs: 00239972

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 4f03540118a5d975823781a46d3e643e64f4d0c344464aa5169918a9bbcff7a7
Instruction ID: 83e24e1d3df6b72efe2554875670bf4e94ee970473066718f35969023ddbc316
Opcode Fuzzy Hash: 4f03540118a5d975823781a46d3e643e64f4d0c344464aa5169918a9bbcff7a7
Instruction Fuzzy Hash: 76210572220305BBE2115F65FD8DF3B3BACEB4BB86F004108F601A6590CBA29C61D677

Function 00246541 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002465CC
__alldvrm.LIBCMT ref: 002467CD
__alldvrm.LIBCMT ref: 002467EF

Strings

>,$, xrefs: 00246557, 002465B2, 002465CB, 00246751
>,$, xrefs: 0024678E
>,$, xrefs: 0024654B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: >,$$>,$$>,$
API String ID: 1036877536-1581211809
Opcode ID: be6c9d0d7c1be526505d416ba69bbcf9729ec644743c8de63497f1cd699fda8f
Instruction ID: bdbf69d3eaa4d292aa621a3be4abcff029cc6b0b5d6d84bf61e2daccb937fd7a
Opcode Fuzzy Hash: be6c9d0d7c1be526505d416ba69bbcf9729ec644743c8de63497f1cd699fda8f
Instruction Fuzzy Hash: 38A18B72A203479FEB19CF18C8997AEFFE5EF52314F14016DE4859B281C6389D61CB52

Function 0022927D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00229282
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 002292A5
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 002292C4

Part of subcall function 00230B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0022AC99,?,?,?,0022AC48,?,-00000002,?,00000000,?), ref: 00230B16

_swprintf.LIBCMT ref: 00229360

Part of subcall function 00223F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00223F3E

MoveFileW.KERNEL32(?,?), ref: 002293D5
MoveFileW.KERNEL32(?,?), ref: 00229411

Strings

rtmp%d, xrefs: 00229349

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: c1325842c5bd6da9842ad9a0e83614df00f59bf6fa661148540e14ea1ddbf6c5
Instruction ID: 24a9f62d06e34e90f720cb7313cb2aa14e0dae4342223d8f8e5ddd6c2a90e46b
Opcode Fuzzy Hash: c1325842c5bd6da9842ad9a0e83614df00f59bf6fa661148540e14ea1ddbf6c5
Instruction Fuzzy Hash: AB418D71921269BADF21FBE0ED44EEA777CAF44341F5040A5B908A7042EA349BE5CF64

Function 00237EE4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,00238704,?), ref: 00237FB9
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000003,00000000,00000000), ref: 00237FDA
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00238001

Strings

<html>, xrefs: 00237F28, 00237F61
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00237F33
utf-8"></head>, xrefs: 00237F3E
</html>, xrefs: 00237F8B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: bf17aa3b0d5a6faf78ba6aa96a77d415a00cdb8154eb948daa7b7b4589f65f49
Instruction ID: 6eb4bd270b814d9d6a641aadea16ffdb06866b70c099cc465bb2daf9fadc1ce3
Opcode Fuzzy Hash: bf17aa3b0d5a6faf78ba6aa96a77d415a00cdb8154eb948daa7b7b4589f65f49
Instruction Fuzzy Hash: D03118B21383167EDB38AB609C06F6FB79CDF52720F104119F914961C1EF7099298BAA

Function 00237D95 Relevance: 12.1, APIs: 8, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00237DAE
GetTickCount.KERNEL32 ref: 00237DCC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00237DE2
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00237DF6
TranslateMessage.USER32(?), ref: 00237E01
DispatchMessageW.USER32(?), ref: 00237E0C
ShowWindow.USER32(?,00000005,?,00000000,?,?,?,?,00000000,00000000,00000000,<html>,00000006), ref: 00237EBC
SetWindowTextW.USER32(?,00000000), ref: 00237EC6

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Message$CountTickWindow$DispatchPeekShowTextTranslate
String ID:
API String ID: 4150546248-0
Opcode ID: 0d95cdc58800506acba7e4884d9ba26401a9cb0125ef5e27f1ac2bd25b5d14b6
Instruction ID: 65e85274ab022c54f65dd6b51c7b5e8aafcbd33c7a7d22a06a04b06d612e7827
Opcode Fuzzy Hash: 0d95cdc58800506acba7e4884d9ba26401a9cb0125ef5e27f1ac2bd25b5d14b6
Instruction Fuzzy Hash: 3A415AB1218306AFDB24DF65D88892B7BE9EF88705F00096DB646C7250DB71EC59CB62

Function 0022FE0E Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0022FE21

Part of subcall function 0022A930: GetVersionExW.KERNEL32(?), ref: 0022A955

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 0022FE4A
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 0022FE5C
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0022FE69
SystemTimeToFileTime.KERNEL32(?,?), ref: 0022FE7F
SystemTimeToFileTime.KERNEL32(?,?), ref: 0022FE8B
FileTimeToSystemTime.KERNEL32(?,?), ref: 0022FEC1
__aullrem.LIBCMT ref: 0022FF4B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 0ea55b24deb8385c9ee3f9d8a0c42b9a8a528557b957fba79bc975c7f2819909
Instruction ID: 81876da67582ede8d521fa0ff6ba738f4339160c148b62e8a8f456850bd8b6af
Opcode Fuzzy Hash: 0ea55b24deb8385c9ee3f9d8a0c42b9a8a528557b957fba79bc975c7f2819909
Instruction Fuzzy Hash: 1B418CB2418315AFC310DFA5D980AABF7F8FF88704F004A2EF58692650E739E558CB56

Function 0024C56D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0024CCE2,00000000,00000000,00000000,00000000,00000000,?), ref: 0024C5AF
__fassign.LIBCMT ref: 0024C62A
__fassign.LIBCMT ref: 0024C645
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0024C66B
WriteFile.KERNEL32(?,00000000,00000000,0024CCE2,00000000,?,?,?,?,?,?,?,?,?,0024CCE2,00000000), ref: 0024C68A
WriteFile.KERNEL32(?,00000000,00000001,0024CCE2,00000000,?,?,?,?,?,?,?,?,?,0024CCE2,00000000), ref: 0024C6C3

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: bf8079d5cb9e7c51c438436f16418fd43663bc8246bbcdf76fe83c5de85fc869
Instruction ID: 2ad3d2c2522f127a90de74fdb3e99e58977d6b68a3264d72d7736932ba8cd0ea
Opcode Fuzzy Hash: bf8079d5cb9e7c51c438436f16418fd43663bc8246bbcdf76fe83c5de85fc869
Instruction Fuzzy Hash: FC51C1B09102099FCB14CFA8D885AEEBBF8FF49310F24815AE955E7291E730A950CF65

Function 0023B0D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0023B0EE
_swprintf.LIBCMT ref: 0023B122

Part of subcall function 00223F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00223F3E

SetDlgItemTextW.USER32(?,00000066,00263122), ref: 0023B142
_wcschr.LIBVCRUNTIME ref: 0023B175
EndDialog.USER32(?,00000001), ref: 0023B256

Strings

%s%s%u, xrefs: 0023B117

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: c13df63c705b653e47122ebccff86889ecc4aadd88be71af4ecdb40ccf38f11a
Instruction ID: 1a928333842d5229f1c48cd3de66504193bcec4a95a1496eb4bfebebae37bd32
Opcode Fuzzy Hash: c13df63c705b653e47122ebccff86889ecc4aadd88be71af4ecdb40ccf38f11a
Instruction Fuzzy Hash: B04174B1D20619AEDF25DF60DD85EEE77BCEB05305F0040A6F90DE6051EBB09AA48F54

Function 0022C96F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0022C9F5
_strlen.LIBCMT ref: 0022CA25
_swprintf.LIBCMT ref: 0022CA46
_wcschr.LIBVCRUNTIME ref: 0022CA6F
_wcsrchr.LIBVCRUNTIME ref: 0022CABB

Strings

%08x, xrefs: 0022CA3A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcsrchr
String ID: %08x
API String ID: 1593746830-3682738293
Opcode ID: 9015ac4c4e687168bde6607411bc40bdf00564f281c789350a37c51c3c70d022
Instruction ID: 97836da8794432b1a841526a9505563335e7d7a3b6532cff9bbfd7b8b40561db
Opcode Fuzzy Hash: 9015ac4c4e687168bde6607411bc40bdf00564f281c789350a37c51c3c70d022
Instruction Fuzzy Hash: E6413B73934365BAD734EEA4EC89EBF73DCDB84310F20052AF94897142D6749D64C6A1

Function 0023859B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 002385B4
GetWindowRect.USER32(?,?), ref: 002385D9
ShowWindow.USER32(?,00000005,?), ref: 00238670
SetWindowTextW.USER32(?,00000000), ref: 00238678
ShowWindow.USER32(00000000,00000005), ref: 0023868E

Strings

RarHtmlClassName, xrefs: 0023863A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: b2289f6761cf82986d26fd51ed9db82b710e1b35f7dc77234f2fe596efe73786
Instruction ID: df978ae900bdb68785b39875850572906fc8a169c7ddb5a5b4985cb1d3338c4e
Opcode Fuzzy Hash: b2289f6761cf82986d26fd51ed9db82b710e1b35f7dc77234f2fe596efe73786
Instruction Fuzzy Hash: A7319C72104310AFC7119F64AD4EA1BBFBCEB48702F004559FE49AA192DB30D910CFA6

Function 00249300 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002492C4: _free.LIBCMT ref: 002492ED

_free.LIBCMT ref: 0024934E

Part of subcall function 002459B2: RtlFreeHeap.NTDLL(00000000,00000000,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?), ref: 002459C8
Part of subcall function 002459B2: GetLastError.KERNEL32(?,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?,?), ref: 002459DA

_free.LIBCMT ref: 00249359
_free.LIBCMT ref: 00249364
_free.LIBCMT ref: 002493B8
_free.LIBCMT ref: 002493C3
_free.LIBCMT ref: 002493CE
_free.LIBCMT ref: 002493D9

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f1ac33a155eeba0822e17f5f402666ce6a004e9925b6c7aeea596f78182db2dd
Instruction ID: 464bb3fb40d27da99b9e19c60482ee68055547507d4aa7ec92361f728f1f879f
Opcode Fuzzy Hash: f1ac33a155eeba0822e17f5f402666ce6a004e9925b6c7aeea596f78182db2dd
Instruction Fuzzy Hash: 3B113071561F14F6DA38FBB0CC47FCF779CAF00710F404915BA9966092D6A5A5A4CE50

Function 00240BB4 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00240BAB,0023E602), ref: 00240BC2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00240BD0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00240BE9
SetLastError.KERNEL32(00000000,?,00240BAB,0023E602), ref: 00240C3B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4ca03a399b3b08573438b40286c30f732d5c52ce7344073a998e551af2351611
Instruction ID: 8218a6d876568b6ba1493c5f54e683fcdc100486d997d67a9d8490a9d6908bfb
Opcode Fuzzy Hash: 4ca03a399b3b08573438b40286c30f732d5c52ce7344073a998e551af2351611
Instruction Fuzzy Hash: 8501D836279B269FE61C2A74FCCA52B2A54EB117BAB20032AF614451E1EFB14CB1954C

Function 0023C7FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 0023C82B
KERNEL32.DLL, xrefs: 0023C816
ReleaseSRWLockExclusive, xrefs: 0023C83B

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: b841f5ccce9ed27cb032d1cfccca86fcf707673e0df837f085722421e29ede8f
Instruction ID: 4e64a589e344d034d10a63204ebe2196b6b7e7bfad353a39177e7243112d2668
Opcode Fuzzy Hash: b841f5ccce9ed27cb032d1cfccca86fcf707673e0df837f085722421e29ede8f
Instruction Fuzzy Hash: 7C0126B1672223D74F221E606CCC6A613845A02372B300139DA11E3140D730C9B4A7A0

Function 0023003E Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 0023009C

Part of subcall function 0022A930: GetVersionExW.KERNEL32(?), ref: 0022A955

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 002300BE
FileTimeToSystemTime.KERNEL32(?,?), ref: 002300D8
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 002300E9
SystemTimeToFileTime.KERNEL32(?,?), ref: 002300F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00230105

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 09faabcf3c628d76efeb42008019ffdaf5c01a91c6b27887eac7a20be21629e3
Instruction ID: a3844f4c81bc6c096e9a29b377bd554e46b7c696e84ad614e0090ff35c655c9d
Opcode Fuzzy Hash: 09faabcf3c628d76efeb42008019ffdaf5c01a91c6b27887eac7a20be21629e3
Instruction Fuzzy Hash: D731D3BA1183469BC704DFA9D8849ABB7F8BF98704F04491EF999D3210E730D559CB2A

Function 0023820D Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00238231
_memcmp.LIBVCRUNTIME ref: 00238248

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f9a26dcb73359bb2ad7a3b07baf965d8dd12c8419c30cade3b9a8f35ed57c6d3
Instruction ID: 3127ab3fb5e88dd78d075137f3c79f323c3c2881683126c55791b76322205b18
Opcode Fuzzy Hash: f9a26dcb73359bb2ad7a3b07baf965d8dd12c8419c30cade3b9a8f35ed57c6d3
Instruction Fuzzy Hash: 0F21D8F1A3064AABEB109E10DC82F37B7ACAB90B44F104524FC049E141E770DD789690

Function 0024630E Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0025CBE8,00242664,0025CBE8,?,?,00242203,?,?,0025CBE8), ref: 00246312
_free.LIBCMT ref: 00246345
_free.LIBCMT ref: 0024636D
SetLastError.KERNEL32(00000000,?,0025CBE8), ref: 0024637A
SetLastError.KERNEL32(00000000,?,0025CBE8), ref: 00246386
_abort.LIBCMT ref: 0024638C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 997c44e37d2f6642dc0d9b1232929727dfac2ddad5ea666e0fce5acc4e1c3132
Instruction ID: 895714fb1b4dc237e6bbe232760040a263db17e30af46b0dbbeca011708ae95a
Opcode Fuzzy Hash: 997c44e37d2f6642dc0d9b1232929727dfac2ddad5ea666e0fce5acc4e1c3132
Instruction Fuzzy Hash: 3CF0A435135A5167C71D2F247C4FF6A1A659BC2B72F240254F828D21D2FF758C218567

Function 0023A8D3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00001000), ref: 0023A92B
CharUpperW.USER32(?,?,?,?,?,00001000), ref: 0023A952

Strings

*a&, xrefs: 0023A99B
-, xrefs: 0023A919

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CharUpper
String ID: *a&$-
API String ID: 9403516-1178523487
Opcode ID: a0570c31688645500d0bf522bfac37004c342cc67d80ad2481e3bc615baa78e2
Instruction ID: 6d4ca9b194225c6f936c98896b7188109ed2442dfe52d09b8e6ddfba7e3a48d3
Opcode Fuzzy Hash: a0570c31688645500d0bf522bfac37004c342cc67d80ad2481e3bc615baa78e2
Instruction Fuzzy Hash: E02129F2434307A5C721AF68A84CB77B6AC9B95310F02443BF5D5E2441D6B4D8F8A763

Function 0023B81F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 002212E7: GetDlgItem.USER32(00000000,00003021), ref: 0022132B
Part of subcall function 002212E7: SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

EndDialog.USER32(?,00000001), ref: 0023B86A
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0023B880
SetDlgItemTextW.USER32(?,00000065,?), ref: 0023B89A
SetDlgItemTextW.USER32(?,00000066), ref: 0023B8A5

Strings

RENAMEDLG, xrefs: 0023B837

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: aa75a4a76e5056e56bd2837c1e0a964bcc482d67f9822ba933f67fcf0c8c72c5
Instruction ID: 4bbc46ccfdc950ec7f6ab2c7778877fb9e918ebc144eb60470ca46084cbf50ed
Opcode Fuzzy Hash: aa75a4a76e5056e56bd2837c1e0a964bcc482d67f9822ba933f67fcf0c8c72c5
Instruction Fuzzy Hash: BA012873AA0322BAD1124EA5BE4DF377B6CE786F41F100415F344B24D0C3A6AC249776

Function 00244A7F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00244A30,?,?,002449D0,?,00257F60,0000000C,00244B27,?,00000002), ref: 00244A9F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00244AB2
FreeLibrary.KERNEL32(00000000,?,?,?,00244A30,?,?,002449D0,?,00257F60,0000000C,00244B27,?,00000002,00000000), ref: 00244AD5

Strings

mscoree.dll, xrefs: 00244A98
CorExitProcess, xrefs: 00244AAA

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c26c888a7aa80e50fc9a777bfac4bc36bc3efbd4ef73852cdc048f4c4d5324b8
Instruction ID: 3db0c0f1aea295abc090067c65c489ad193bfbf79f5937bf4b6c00bbd09a14f1
Opcode Fuzzy Hash: c26c888a7aa80e50fc9a777bfac4bc36bc3efbd4ef73852cdc048f4c4d5324b8
Instruction Fuzzy Hash: 9FF06231A51319BBCB15AF90EC5DB9EBFB8EF04722F0441A4F809A61A0DB754E54CB98

Function 0022DF05 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0022F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0022F376
Part of subcall function 0022F35B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0022DF18,Crypt32.dll,?,0022DF9C,?,0022DF7E,?,?,?,?), ref: 0022F398

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0022DF24
GetProcAddress.KERNEL32(00261E58,CryptUnprotectMemory), ref: 0022DF34

Strings

CryptUnprotectMemory, xrefs: 0022DF2A
Crypt32.dll, xrefs: 0022DF0E
CryptProtectMemory, xrefs: 0022DF1E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 1278295e5717d05c84191cf1be00a45eb225851738bc5b98ecf93c005207f730
Instruction ID: 7eff344ae9a94a270e487824fb660c5091b53c7a38b421f0de2ed91825a4354a
Opcode Fuzzy Hash: 1278295e5717d05c84191cf1be00a45eb225851738bc5b98ecf93c005207f730
Instruction Fuzzy Hash: 9AE04FB0524743BEDB405FB4AD88B04FBA87F95721F048165F419D2580D7B4D0B88B5C

Function 002452C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00245333
_free.LIBCMT ref: 00245353

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a62630a1704bc824ebcf39b4268598a1ee95ee91f99fea5a7daf55ed11ee2b74
Instruction ID: a815b3135000f4259a7b77596318ca78da0497c35c746a37c3cd02a1bcee8e8f
Opcode Fuzzy Hash: a62630a1704bc824ebcf39b4268598a1ee95ee91f99fea5a7daf55ed11ee2b74
Instruction Fuzzy Hash: DA41D532A20A209FCB28DF78C881A5DB7B5EF88710F1545A9E555EB382DB71AD11CB81

Function 002489A0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002489A9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002489CC

Part of subcall function 002459EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,0024239A,?,0000015D,?,?,?,?,00242F19,000000FF,00000000,?,?), ref: 00245A1E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 002489F2
_free.LIBCMT ref: 00248A05
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00248A14

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 93c5e27d4556f7595be1632b1ac74815b6865e0da0a66ca3a16576807f3643af
Instruction ID: 528fad55aa7cacee00e380701b3b15cc9a6a99905d647aff82fc67b5f26d64b4
Opcode Fuzzy Hash: 93c5e27d4556f7595be1632b1ac74815b6865e0da0a66ca3a16576807f3643af
Instruction Fuzzy Hash: 520175726326667F27295EA66C8DC7F696DDBCAFA1314011AFD04D2141DEB08C1189B1

Function 00246392 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00245E33,00245ACF,?,0024633C,00000001,00000364,?,00242203,?,?,0025CBE8), ref: 00246397
_free.LIBCMT ref: 002463CC
_free.LIBCMT ref: 002463F3
SetLastError.KERNEL32(00000000,?,0025CBE8), ref: 00246400
SetLastError.KERNEL32(00000000,?,0025CBE8), ref: 00246409

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 93b453d115bc035350756c6d34438454ff1448aac3115452d3a0e44acf2cc113
Instruction ID: 4f72c85cf1fc5e0b1d742bfed673d8b5ee0869454ea129f28fb39708a0f7746b
Opcode Fuzzy Hash: 93b453d115bc035350756c6d34438454ff1448aac3115452d3a0e44acf2cc113
Instruction Fuzzy Hash: B201FE72175B11678B1D3F247C8ED3B2569DBD2772B210124F814D2193EF75C8214567

Function 0024925B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00249273

Part of subcall function 002459B2: RtlFreeHeap.NTDLL(00000000,00000000,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?), ref: 002459C8
Part of subcall function 002459B2: GetLastError.KERNEL32(?,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?,?), ref: 002459DA

_free.LIBCMT ref: 00249285
_free.LIBCMT ref: 00249297
_free.LIBCMT ref: 002492A9
_free.LIBCMT ref: 002492BB

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1077227cfc5d0bc9d40289d167fbb50d3f9dcc6c5676b183fea621ade6e2fc1d
Instruction ID: f6b043801c98a759e773ffc7431e0d5d41d725339a1971e3c8077919e5002410
Opcode Fuzzy Hash: 1077227cfc5d0bc9d40289d167fbb50d3f9dcc6c5676b183fea621ade6e2fc1d
Instruction Fuzzy Hash: 16F0FF32526B15FB9A2CEF58F88BC1A77E9FA007207644905F848E7602C674FCD08A94

Function 00245513 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00245531

Part of subcall function 002459B2: RtlFreeHeap.NTDLL(00000000,00000000,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?), ref: 002459C8
Part of subcall function 002459B2: GetLastError.KERNEL32(?,?,002492F2,?,00000000,?,00000000,?,00249319,?,00000007,?,?,00249716,?,?), ref: 002459DA

_free.LIBCMT ref: 00245543
_free.LIBCMT ref: 00245556
_free.LIBCMT ref: 00245567
_free.LIBCMT ref: 00245578

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ebe888295b6df3bb18c2dbe41c266bbc2e2774de2b6ec93bd496662042e39d65
Instruction ID: a7669c292f62ad9e5289c602814cd086f75026d987addbe83a0364b3d283b623
Opcode Fuzzy Hash: ebe888295b6df3bb18c2dbe41c266bbc2e2774de2b6ec93bd496662042e39d65
Instruction Fuzzy Hash: 41F017B0832A209B9F1A6F18BC0A40D3BB4FB04731381024AF85896262D73908E2DED7

Function 00244B7A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe,00000104), ref: 00244BBA
_free.LIBCMT ref: 00244C85
_free.LIBCMT ref: 00244C8F

Strings

C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe, xrefs: 00244BB1, 00244BB8, 00244BE7, 00244C1F

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\T.T_Copy.12.18.2024.exe
API String ID: 2506810119-1612214765
Opcode ID: 45465b2e5b93055f02d75de39a733a9e202df14a2bc0ec9a5c49cfccba68cb7a
Instruction ID: 37e8dc92c8df0bd070f371c477a7a413d715faae43d22a7b5e0044750ae69fa2
Opcode Fuzzy Hash: 45465b2e5b93055f02d75de39a733a9e202df14a2bc0ec9a5c49cfccba68cb7a
Instruction Fuzzy Hash: 06318671A11259EFDB29EF99DC85B9EBBFCEF84710B144097F8049B211D7708A90CB90

Function 00227463 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00227468

Part of subcall function 00223A90: __EH_prolog.LIBCMT ref: 00223A95

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000), ref: 0022752E

Part of subcall function 00227A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00227AAC
Part of subcall function 00227A9D: GetLastError.KERNEL32 ref: 00227AF2
Part of subcall function 00227A9D: CloseHandle.KERNEL32(?), ref: 00227B01

Strings

SeRestorePrivilege, xrefs: 002274C1
SeSecurityPrivilege, xrefs: 002274AC

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: fcdacd3e1e78489a47007a1ea8a71d17102b918e8595f043ba1ffaf11ffe11fd
Instruction ID: 5cff2b686b40807a2ae9558efef4c2798b04d828e24dab96f16453581cb8dbaf
Opcode Fuzzy Hash: fcdacd3e1e78489a47007a1ea8a71d17102b918e8595f043ba1ffaf11ffe11fd
Instruction Fuzzy Hash: BE31BE71928329BEDF20EFA4BC46BEEBB78AF14314F504065F849A7242D7704A748B61

Function 00239122 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 002212E7: GetDlgItem.USER32(00000000,00003021), ref: 0022132B
Part of subcall function 002212E7: SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

EndDialog.USER32(?,00000001), ref: 002391AA
GetDlgItemTextW.USER32(?,00000065,00000000,?), ref: 002391BF
SetDlgItemTextW.USER32(?,00000065,?), ref: 002391D4

Strings

ASKNEXTVOL, xrefs: 0023913A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 08ecf575df395bb095dd8559b629d3444de113a01b11dccfc88854bb3753267e
Instruction ID: d58935dd5ea6c3cc0479a036a25918dd87d98558d89613b13d669825cc18f4dd
Opcode Fuzzy Hash: 08ecf575df395bb095dd8559b629d3444de113a01b11dccfc88854bb3753267e
Instruction Fuzzy Hash: 7A11DA72260223BFE6119FA8ED4DF667769EB47701F004011F748A70A0C3A19CB19B66

Function 0023BFA9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,?,00239645,?,?), ref: 0023C021

Strings

*a&, xrefs: 0023C064
GETPASSWORD1, xrefs: 0023C016
*a&, xrefs: 0023BFC7

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: DialogParam
String ID: *a&$*a&$GETPASSWORD1
API String ID: 665744214-285589960
Opcode ID: 15104c583119be66b3516be6f9f31f5d3c7db161e7f943ff97c89e1c8d7c4396
Instruction ID: 85f75f2fb140a418f8d6d5c6aa903217f9a8927a42b6664e7363e295c5c6c916
Opcode Fuzzy Hash: 15104c583119be66b3516be6f9f31f5d3c7db161e7f943ff97c89e1c8d7c4396
Instruction Fuzzy Hash: C3119B72634314ABDB12DE24BC49BAA3798FB0A761F144065FD08B71C1D6F14CB0DB98

Function 00239645 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 002212E7: GetDlgItem.USER32(00000000,00003021), ref: 0022132B
Part of subcall function 002212E7: SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

EndDialog.USER32(?,00000001), ref: 00239693
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 002396AB
SetDlgItemTextW.USER32(?,00000066,?), ref: 002396D9

Strings

GETPASSWORD1, xrefs: 0023965E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 384d5827a85544c448b6b8e4ef80cac6be620570a663a9974b990e6c309979c1
Instruction ID: 58846209ca665f48fe1b32c8e304ff619df63b1338a47b1f1cfe1dfc9dcfd61e
Opcode Fuzzy Hash: 384d5827a85544c448b6b8e4ef80cac6be620570a663a9974b990e6c309979c1
Instruction Fuzzy Hash: 9811C2729212297BDB215E74AD4BFFA377CAB4A711F000011FA05E6080C2E5ADA09EA5

Function 0022B150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0022B177

Part of subcall function 00223F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00223F3E

_wcschr.LIBVCRUNTIME ref: 0022B195
_wcschr.LIBVCRUNTIME ref: 0022B1A5

Strings

%c:\, xrefs: 0022B16D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 9d856f32aae6dc0e50df8ba2b484f33a5f087ea6901d4e2af2a6bdc51e101202
Instruction ID: d53a7f86216376128523f916fb91362e96a552d1f5c30c2a52802a8f0697f1ba
Opcode Fuzzy Hash: 9d856f32aae6dc0e50df8ba2b484f33a5f087ea6901d4e2af2a6bdc51e101202
Instruction Fuzzy Hash: E401FE6352032375D6316FB56C82D6BA7ACEE95360B504406FD48D6481FB30D470C7B1

Function 0022F982 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,00000000,00261E74,?,?,0022FB9D,00000020,?,0022A812,?,0022C79B,?,00000000,?,00000001,?), ref: 0022F9BB
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,0022A812,?,0022C79B,?,00000000,?,00000001,?,?,?,00233AFE), ref: 0022F9C5
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,0022A812,?,0022C79B,?,00000000,?,00000001,?,?,?,00233AFE), ref: 0022F9D5

Strings

Thread pool initialization failed., xrefs: 0022F9ED

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 3b56fef4f1e1f27e86e529099c1c39ad65a24237ade80bf68cd1fbfa34b02d55
Instruction ID: 5515ccd89dd038f8158b77030370d8f19430f9dbd65f66980a52652f264a414a
Opcode Fuzzy Hash: 3b56fef4f1e1f27e86e529099c1c39ad65a24237ade80bf68cd1fbfa34b02d55
Instruction Fuzzy Hash: 9C1170B1610715BFD3305FA5AD89AA7FBECFB95756F10483EE6DA82240DA712890CB10

Function 0023BEE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0023BF41
REPLACEFILEDLG, xrefs: 0023BF2B, 0023BF5D

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 0822c206440f87d391ff5dc977f3d45d87303e4098645bbaec51ff9235227b6b
Instruction ID: fe0f578aee923ae5511824bb6caf4f9b0634ca843cc6bc03a588dbe10cfc040b
Opcode Fuzzy Hash: 0822c206440f87d391ff5dc977f3d45d87303e4098645bbaec51ff9235227b6b
Instruction Fuzzy Hash: E801B1B1A29302FFC312CF28FC09E22BB98E749394F004466FA4492530E3718C29DF66

Function 0022CE98 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0022CEA7
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0022CEB6

Strings

LTR, xrefs: 0022CEC6, 0022CED1, 0022CEDA
RTL, xrefs: 0022CEAF, 0022CEB4, 0022CEE8

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: 89c46185f8a2e562960156ec72ba512bb57fe3b8c54e427dc39187da9c931801
Instruction ID: e6477e6f8d990181fea034fab03d554ce2a0c93af35329e172182e0f94bc075c
Opcode Fuzzy Hash: 89c46185f8a2e562960156ec72ba512bb57fe3b8c54e427dc39187da9c931801
Instruction Fuzzy Hash: 32F08B3162435477E62466B47C0AFAB37ACE780B11F10025DF602970C0CFB1951C87B8

Function 00229F7A Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00227F55,?,?,?), ref: 0022A020
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00227F55,?,?), ref: 0022A064
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00227F55,?,?,?,?,?,?,?,?), ref: 0022A0E5
CloseHandle.KERNEL32(?,?,00000000,?,00227F55,?,?,?,?,?,?,?,?,?,?,?), ref: 0022A0EC

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 1271836c678eb40235ba6e18ce8b1b88a22f079861580021f2536bb33cfb9337
Instruction ID: fc4bb8961a2b1dad96ca17b9d7001bf474f5c3e52cec23dc1028215c08110e7d
Opcode Fuzzy Hash: 1271836c678eb40235ba6e18ce8b1b88a22f079861580021f2536bb33cfb9337
Instruction Fuzzy Hash: 4841E131268392ABD731DE64EC46BAFBBE8AB85700F040918F5D5D35C0C6749A58CB53

Function 002493E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F5E85006,00242784,00000000,00000000,00242FB2,?,00242FB2,?,00000001,00242784,F5E85006,00000001,00242FB2,00242FB2), ref: 00249431
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 002494BA
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 002494CC
__freea.LIBCMT ref: 002494D5

Part of subcall function 002459EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,0024239A,?,0000015D,?,?,?,?,00242F19,000000FF,00000000,?,?), ref: 00245A1E

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 2ca71fece2cdc0bc5871990f5908e73e4ca10d008d98bb7ed645ee76bfe22b8c
Instruction ID: d93b231d8285b55c27a8d9924abe598a5bce4744c92597e70043525e757d002e
Opcode Fuzzy Hash: 2ca71fece2cdc0bc5871990f5908e73e4ca10d008d98bb7ed645ee76bfe22b8c
Instruction Fuzzy Hash: 0D31AE72A2020AABDF29DF64DC85DAF7BA5EB40710F054268FC14D7191E735CDA1CB90

Function 00239A75 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00239A85
GetObjectW.GDI32(00000000,00000018,?), ref: 00239AA6
DeleteObject.GDI32(00000000), ref: 00239ACE
DeleteObject.GDI32(00000000), ref: 00239AED

Part of subcall function 00238BCF: FindResourceW.KERNEL32(00000066,PNG,?,?,00239AC7,00000066), ref: 00238BE0
Part of subcall function 00238BCF: SizeofResource.KERNEL32(00000000,75755780,?,?,00239AC7,00000066), ref: 00238BF8
Part of subcall function 00238BCF: LoadResource.KERNEL32(00000000,?,?,00239AC7,00000066), ref: 00238C0B
Part of subcall function 00238BCF: LockResource.KERNEL32(00000000,?,?,00239AC7,00000066), ref: 00238C16

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: 0f66be3f93147b5ef55e0ffa757debaa4fee3ce410df0a9ffd2bbea5be688cb3
Instruction ID: e9beeaa3028039e500e3952448c3d1fbd3448622ce5e38bc0c2534b50e257183
Opcode Fuzzy Hash: 0f66be3f93147b5ef55e0ffa757debaa4fee3ce410df0a9ffd2bbea5be688cb3
Instruction Fuzzy Hash: F5012BB255031627C61177785D47E7FB67EDF85B52F080111FD00EB251EEA18C3186A5

Function 00240FD6 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00240FED

Part of subcall function 00241625: ___AdjustPointer.LIBCMT ref: 0024166F

_UnwindNestedFrames.LIBCMT ref: 00241004
___FrameUnwindToState.LIBVCRUNTIME ref: 00241016
CallCatchBlock.LIBVCRUNTIME ref: 0024103A

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: b9fa4c2ca776b65944230fb083eb0fa8b0de912ee33a1d220a96a688825d65b2
Instruction ID: 3b6d79ddf104e7459229fbc6bf88c7eacde8a0b25721832e4f6d75745caf0bda
Opcode Fuzzy Hash: b9fa4c2ca776b65944230fb083eb0fa8b0de912ee33a1d220a96a688825d65b2
Instruction Fuzzy Hash: FB011332010149BBCF266F95DC42EDA3FAAEF48754F054014FE1866121C776E8B1EFA4

Function 0022FB54 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0022FB59
EnterCriticalSection.KERNEL32(00261E74,?,?,0022A812,?,0022C79B,?,00000000,?,00000001,?,?,?,00233AFE,?,00008000), ref: 0022FB66
new.LIBCMT ref: 0022FB82

Part of subcall function 0022F982: InitializeCriticalSection.KERNEL32(000001A0,00000000,00261E74,?,?,0022FB9D,00000020,?,0022A812,?,0022C79B,?,00000000,?,00000001,?), ref: 0022F9BB
Part of subcall function 0022F982: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,0022A812,?,0022C79B,?,00000000,?,00000001,?,?,?,00233AFE), ref: 0022F9C5
Part of subcall function 0022F982: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,0022A812,?,0022C79B,?,00000000,?,00000001,?,?,?,00233AFE), ref: 0022F9D5

LeaveCriticalSection.KERNEL32(00261E74,?,0022A812,?,0022C79B,?,00000000,?,00000001,?,?,?,00233AFE,?,00008000,?), ref: 0022FBA3

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CriticalSection$Create$EnterEventH_prologInitializeLeaveSemaphore
String ID:
API String ID: 3780591329-0
Opcode ID: 04af0466086ad243c21163e07c906fda7e03ea727dbe0e507a7b46517e1c8396
Instruction ID: 7b1c4ce5610b1b904ee5763980a02c323a871828ff843bd94962cbb1aa95292c
Opcode Fuzzy Hash: 04af0466086ad243c21163e07c906fda7e03ea727dbe0e507a7b46517e1c8396
Instruction Fuzzy Hash: 89F01275A112159BD7889F68FC15AA976B4EB49315F04413AFC09D3250DBB199208B54

Function 00240B06 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00240B06
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00240B0B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00240B10

Part of subcall function 00241BDE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00241BEF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00240B25

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 531e6f4e0a03c94a47563f5691ee99a7aac98bf87a5ed1e2fb88b7d1485fc598
Instruction ID: 665f66dbce777cbf1914ebcd701adb95991011c4222063eb3303422808e5afbe
Opcode Fuzzy Hash: 531e6f4e0a03c94a47563f5691ee99a7aac98bf87a5ed1e2fb88b7d1485fc598
Instruction Fuzzy Hash: 65C04C18770256941D2E3EB165C21ED33409C627CC78015C2EA541F5079A6608FB5C3B

Function 00238CF2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00238BA4: GetDC.USER32(00000000), ref: 00238BA8
Part of subcall function 00238BA4: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00238BB3
Part of subcall function 00238BA4: ReleaseDC.USER32(00000000,00000000), ref: 00238BBE

GetObjectW.GDI32(?,00000018,?), ref: 00238D23

Part of subcall function 00238EE9: GetDC.USER32(00000000), ref: 00238EF2
Part of subcall function 00238EE9: GetObjectW.GDI32(?,00000018,?), ref: 00238F21
Part of subcall function 00238EE9: ReleaseDC.USER32(00000000,?), ref: 00238FB5

Strings

(, xrefs: 00238DEE

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 20643291f25aaf24221837dbd774f206407395f5b6e4b05a9384329509053552
Instruction ID: 5d1c225961381e5c5c0ab43607af1dcbdafde9bfe48dd5683545ddd42cdcae93
Opcode Fuzzy Hash: 20643291f25aaf24221837dbd774f206407395f5b6e4b05a9384329509053552
Instruction Fuzzy Hash: B16124B1218305AFD210DF64C888E6BBBE9EF89704F10491DF599CB260DB71E919CB62

Function 002301CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00230393

Strings

%s: %s, xrefs: 002303A2
%ls, xrefs: 0023020C, 00230222

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 7f85cc4c64e9e9f7722154029e1aa575969b51e51629705451aafd43599cc32c
Instruction ID: ca841dc5330610a6839321422bda613f5f44df67646d34146e1c4a180de5f7dc
Opcode Fuzzy Hash: 7f85cc4c64e9e9f7722154029e1aa575969b51e51629705451aafd43599cc32c
Instruction Fuzzy Hash: FE5198F12B8300F6E7351A949DFAF377655AB05F00F608506BF8E644D1C5E1A970AB3A

Function 00247BD9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00247D45

Part of subcall function 00245D1D: IsProcessorFeaturePresent.KERNEL32(00000017,00245D0C,0000002C,002580C8,00248D62,00000000,00000000,00246391,?,?,00245D19,00000000,00000000,00000000,00000000,00000000), ref: 00245D1F
Part of subcall function 00245D1D: GetCurrentProcess.KERNEL32(C0000417,002580C8,0000002C,00245A4A,00000016,00246391), ref: 00245D41
Part of subcall function 00245D1D: TerminateProcess.KERNEL32(00000000), ref: 00245D48

Strings

., xrefs: 00247EFC
*?, xrefs: 00247C1C

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 7b97f05bead931982e7a23c9cf534e270e960d3348eeadaf4e8a2cba3451af48
Instruction ID: 4ddb684d31b9fcfa104ffdf3da5b72fab3daa1e6e95c0e52cd42abdfc231c19f
Opcode Fuzzy Hash: 7b97f05bead931982e7a23c9cf534e270e960d3348eeadaf4e8a2cba3451af48
Instruction Fuzzy Hash: 1051B171E2421AEFDF18DFA8C881AADB7B5EF48314F24416AE864E7341E7719A118F50

Function 00227619 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0022761E
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00227799

Part of subcall function 0022A113: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00229F49,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 0022A127
Part of subcall function 0022A113: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00229F49,?,?,?,00229DE2,?,00000001,00000000,?,?), ref: 0022A158

Strings

:, xrefs: 0022768F

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: dfe9b3cf814ab265d28ee89f8fffafa1a4e0b365e4f12a00d0ac5d361229c066
Instruction ID: 2a8c3e056f39ddbe111115755d853e89dd6cea9403b8591ccd46af69082f2650
Opcode Fuzzy Hash: dfe9b3cf814ab265d28ee89f8fffafa1a4e0b365e4f12a00d0ac5d361229c066
Instruction Fuzzy Hash: 2441A471829268BADB34EFA0EC45EEEB77CEF45340F4040A9B50566052DB745FA5CF60

Function 0022B2C5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 0022B317, 0022B353, 0022B3B4, 0022B407
UNC, xrefs: 0022B361

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 344732ca5a7064afbf1e8d507d09396187df1d2901de975694336b42050291ff
Instruction ID: 4e51533e14d55017b1da86f50a419b9842a35da06987c3ce51d5fa79a6df5200
Opcode Fuzzy Hash: 344732ca5a7064afbf1e8d507d09396187df1d2901de975694336b42050291ff
Instruction Fuzzy Hash: CD41923542027ABACF22BFA1FC81EEE77B9BF01350F904565F85496042E77099B4DA90

Function 0023802C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00238039

Strings

about:blank, xrefs: 002380D1
Shell.Explorer, xrefs: 00238065

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 0feb4ada04ae8b002629b14461436d3d988c90de9aee5a1f93929ffb1d382968
Instruction ID: 87d9dde305626d240e6caafecbe4090e4af2a33ce053450ee99d324aa1a30795
Opcode Fuzzy Hash: 0feb4ada04ae8b002629b14461436d3d988c90de9aee5a1f93929ffb1d382968
Instruction Fuzzy Hash: 5B2180B5230706AFD7089F64C890E26B769BF85710F148519B5058F242CF71EC64CB90

Function 0022DF86 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0022DF05: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0022DF24
Part of subcall function 0022DF05: GetProcAddress.KERNEL32(00261E58,CryptUnprotectMemory), ref: 0022DF34

GetCurrentProcessId.KERNEL32(?,?,?,0022DF7E), ref: 0022E007

Strings

CryptUnprotectMemory failed, xrefs: 0022DFFF
CryptProtectMemory failed, xrefs: 0022DFC7

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 97af66d49bc295b1cf746e4921a00c78784813a859c6ff75e4d48004d5f23ab3
Instruction ID: 515c2691c9e1282073f2b6f88136df5e8df7bd37899564cf4eca5a29722098f8
Opcode Fuzzy Hash: 97af66d49bc295b1cf746e4921a00c78784813a859c6ff75e4d48004d5f23ab3
Instruction Fuzzy Hash: BA115B317242327BDF249FB9FC54A7A33999F84B50B094019F801EB192DBF1EE329694

Function 002212E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0022CF27: GetWindowRect.USER32(?,?), ref: 0022CF5E
Part of subcall function 0022CF27: GetClientRect.USER32(?,?), ref: 0022CF6A
Part of subcall function 0022CF27: GetWindowLongW.USER32(?,000000F0), ref: 0022D00B
Part of subcall function 0022CF27: GetWindowRect.USER32(?,?), ref: 0022D038
Part of subcall function 0022CF27: GetWindowTextW.USER32(?,?,00000400), ref: 0022D057

GetDlgItem.USER32(00000000,00003021), ref: 0022132B
SetWindowTextW.USER32(00000000,002502E4), ref: 00221341

Strings

0, xrefs: 002212EA

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLong
String ID: 0
API String ID: 660763476-4108050209
Opcode ID: 070df14e1c1186ea286635cf2feeb9942eddd42acac858472bc15fd637deb8d4
Instruction ID: 886f675d0c83490f00ae72e9a996ad12e45c4f0b0bbee396e6f21b1b7aa89b63
Opcode Fuzzy Hash: 070df14e1c1186ea286635cf2feeb9942eddd42acac858472bc15fd637deb8d4
Instruction Fuzzy Hash: 67F0F470420359BBCF114F90AC0EEE93B5BAB2874AF084045FD4494490C774C474DF99

Function 0022FB19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,0022FCF9,?,?,0022FD6E,?,?,?,?,?,0022FD58), ref: 0022FB1F
GetLastError.KERNEL32(?,?,0022FD6E,?,?,?,?,?,0022FD58), ref: 0022FB2B

Part of subcall function 00226D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00226DAD

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 0022FB34

Memory Dump Source

Source File: 00000001.00000002.1450511225.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000001.00000002.1450484971.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450554230.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000025E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450577769.000000000027A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1450663496.000000000027C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_220000_T.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 92bb73491c9730e152078e21254753feedbae2d4d5614ef9556786efdab762d0
Instruction ID: 09352e56eb4826e45acf42b774deb6380269f7c4829a98ad1e3f2cd2660e48ca
Opcode Fuzzy Hash: 92bb73491c9730e152078e21254753feedbae2d4d5614ef9556786efdab762d0
Instruction Fuzzy Hash: BFD02B3252813037C50023647C5EE7F39045B12736F640314F535651E0CA3008624699

Analysis Process: dfbzdfb.sfx.exePID: 5428, Parent PID: 2828COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1514
Total number of Limit Nodes:	24

Executed Functions

Function 00BEC130 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDF3A5: GetModuleHandleW.KERNEL32 ref: 00BDF3BD
Part of subcall function 00BDF3A5: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BDF3D5
Part of subcall function 00BDF3A5: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BDF3F8

Part of subcall function 00BE8B8D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00BE8B95

Part of subcall function 00BE9035: OleInitialize.OLE32(00000000), ref: 00BE904E
Part of subcall function 00BE9035: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BE9085
Part of subcall function 00BE9035: SHGetMalloc.SHELL32(00C120E8), ref: 00BE908F

Part of subcall function 00BE0710: GetCPInfo.KERNEL32(00000000,?), ref: 00BE0721
Part of subcall function 00BE0710: IsDBCSLeadByte.KERNEL32(00000000), ref: 00BE0735

GetCommandLineW.KERNEL32 ref: 00BEC178
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00BEC19F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00BEC1B0
UnmapViewOfFile.KERNEL32(00000000), ref: 00BEC1EA

Part of subcall function 00BEBE09: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00BEBE1F
Part of subcall function 00BEBE09: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BEBE5B

CloseHandle.KERNEL32(00000000), ref: 00BEC1F3
GetModuleFileNameW.KERNEL32(00000000,00C27938,00000800), ref: 00BEC20E
SetEnvironmentVariableW.KERNEL32(sfxname,00C27938), ref: 00BEC220
GetLocalTime.KERNEL32(?), ref: 00BEC227
_swprintf.LIBCMT ref: 00BEC266
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00BEC278
GetModuleHandleW.KERNEL32(00000000), ref: 00BEC27B
LoadIconW.USER32(00000000,00000064), ref: 00BEC292
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00019B4E,00000000), ref: 00BEC2E3
Sleep.KERNEL32(?), ref: 00BEC311
DeleteObject.GDI32 ref: 00BEC350
DeleteObject.GDI32(?), ref: 00BEC35C

Part of subcall function 00BEA8D3: CharUpperW.USER32(?,?,?,?,00001000), ref: 00BEA92B
Part of subcall function 00BEA8D3: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 00BEA952

CloseHandle.KERNEL32 ref: 00BEC39B

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00BEC257
winrarsfxmappingfile.tmp, xrefs: 00BEC193
sfxstime, xrefs: 00BEC273
STARTDLG, xrefs: 00BEC2D8
sfxname, xrefs: 00BEC21B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseDeleteObjectProcUpperView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 985665271-3710569615
Opcode ID: 280adb418a5eef75a870705381497440c97df5054005756e4aa557b9ff1e6d93
Instruction ID: 1085b10bd6462b665c4a7143da348248442fea169c4e2a3b24530b913f0689f5
Opcode Fuzzy Hash: 280adb418a5eef75a870705381497440c97df5054005756e4aa557b9ff1e6d93
Instruction Fuzzy Hash: 97610971904384AFD720AB76EC49F6F7BECEB49700F15446AF905931A2EBB48C45C7A2

Function 00BDA2C3 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,00BDA1BE,000000FF,?,?), ref: 00BDA2F8
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00BDA1BE,000000FF,?,?), ref: 00BDA32E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00BDA1BE,000000FF,?,?), ref: 00BDA336
FindNextFileW.KERNEL32(?,?,?,?,?,?,00BDA1BE,000000FF,?,?), ref: 00BDA35E
GetLastError.KERNEL32(?,?,?,?,00BDA1BE,000000FF,?,?), ref: 00BDA36A

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 979ea5d8c53ca4503f394c5ce0bbb497898dc69cb6e1c18227c48637cb690501
Instruction ID: 22a60c7561f658183054192692594b03fa500d0f3a8118bdd4465809a5dd2017
Opcode Fuzzy Hash: 979ea5d8c53ca4503f394c5ce0bbb497898dc69cb6e1c18227c48637cb690501
Instruction Fuzzy Hash: 02417F72604281AFC324EF78C880BDAF7E9FF49350F050A6AF5D9D3240E774A9548B96

Function 00BF49FA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00BF49D0,?,00C07F60,0000000C,00BF4B27,?,00000002,00000000), ref: 00BF4A1B
TerminateProcess.KERNEL32(00000000,?,00BF49D0,?,00C07F60,0000000C,00BF4B27,?,00000002,00000000), ref: 00BF4A22
ExitProcess.KERNEL32 ref: 00BF4A34

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 86c0fcc793c16b25d8405a296c520e0e543c5e34a1f9fbdd221a97cb19f934fc
Instruction ID: be56693b3a33408a861ff40336bf8b8089758a30a87d6abe5194e68ee6dde04e
Opcode Fuzzy Hash: 86c0fcc793c16b25d8405a296c520e0e543c5e34a1f9fbdd221a97cb19f934fc
Instruction Fuzzy Hash: F1E04631040108AFCF11AF24DC08BAD3BA9EB01342F1200A4FA089B132CB35DE86DB40

Function 00BD83EB Relevance: 3.9, APIs: 2, Instructions: 931COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD83F0
_memcmp.LIBVCRUNTIME ref: 00BD8858

Part of subcall function 00BD80DA: CharUpperW.USER32(?,?,00000000,?,?,?,?,?,?,?,00000800,?,00BD86CF,?,-00000930,?), ref: 00BD819D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CharH_prologUpper_memcmp
String ID:
API String ID: 4047935103-0
Opcode ID: d5b90d30448d3f3727be48f63c1cb95431aaabef3365ad7dd017abd3c2bff2e6
Instruction ID: ec7d0cdb237177937d80f5e4f1807a9e6f85fc1f38dd9f8e00af1fda5f61b61d
Opcode Fuzzy Hash: d5b90d30448d3f3727be48f63c1cb95431aaabef3365ad7dd017abd3c2bff2e6
Instruction Fuzzy Hash: 5672B371904185AEDF15DB64C885BF9FBE9EF15301F0841FBE8499B382EB319A85CB60

Function 00BE9B4E Relevance: 95.2, APIs: 46, Strings: 8, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BE9B53

Part of subcall function 00BD12E7: GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
Part of subcall function 00BD12E7: SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

Strings

@, xrefs: 00BE9F0D
"%s"%s, xrefs: 00BEA089
LICENSEDLG, xrefs: 00BEA3D3
winrarsfxmappingfile.tmp, xrefs: 00BE9F22
-el -s2 "-d%s" "-sp%s", xrefs: 00BE9EE7
<, xrefs: 00BE9F00
STARTDLG, xrefs: 00BE9B72
__tmp_rar_sfx_access_check_%u, xrefs: 00BE9E2D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-2803697902
Opcode ID: d358c91ea10919f67a78fc30a53480f32068db54cd312c4570fdf4a1fdc7d503
Instruction ID: bf40986ba8748fff5a47dd80ff06d10d1c56c16c7426fc4900b621728511e0ba
Opcode Fuzzy Hash: d358c91ea10919f67a78fc30a53480f32068db54cd312c4570fdf4a1fdc7d503
Instruction Fuzzy Hash: 8F420471A40384BFEB21AB619C8AFEE7BECEB06700F1040D5F641A61D2D7B45D44DB66

Function 00BDF3A5 Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00BDF3BD
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BDF3D5
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BDF3F8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BDF6A3
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BDF6BB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BDF6CD
ReadFile.KERNEL32(00000000,?,00007FFE,00C00858,00000000), ref: 00BDF6EC
CloseHandle.KERNEL32(00000000), ref: 00BDF744
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BDF75A
CompareStringW.KERNEL32(00000400,00001001,00C008A4,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 00BDF7B4
GetFileAttributesW.KERNEL32(?,?,00C00870,00000800,?,00000000,?,00000800), ref: 00BDF7DD
GetFileAttributesW.KERNEL32(?,?,00C00930,00000800), ref: 00BDF816

Part of subcall function 00BDF35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BDF376
Part of subcall function 00BDF35B: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00BDDF18,Crypt32.dll,?,00BDDF9C,?,00BDDF7E,?,?,?,?), ref: 00BDF398

_swprintf.LIBCMT ref: 00BDF886
_swprintf.LIBCMT ref: 00BDF8D2

Part of subcall function 00BD3F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD3F3E

AllocConsole.KERNEL32 ref: 00BDF8DA
GetCurrentProcessId.KERNEL32 ref: 00BDF8E4
AttachConsole.KERNEL32(00000000), ref: 00BDF8EB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00BDF911
WriteConsoleW.KERNEL32(00000000), ref: 00BDF918
Sleep.KERNEL32(00002710), ref: 00BDF923
FreeConsole.KERNEL32 ref: 00BDF929
ExitProcess.KERNEL32 ref: 00BDF931

Strings

Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00BDF8C0
SetDefaultDllDirectories, xrefs: 00BDF3F2
kernel32, xrefs: 00BDF3B3
dwmapi.dll, xrefs: 00BDF460, 00BDF849
DXGIDebug.dll, xrefs: 00BDF435, 00BDF7A0
SetDllDirectoryW, xrefs: 00BDF3CF
uxtheme.dll, xrefs: 00BDF853

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: 596d02146311f6e072c701cb13874d43eaf281e482e8b84d74ba7bd614a2ba36
Instruction ID: e428746d9f39e5cb22706caf8d6ab553bf0fd47cbd183521183813451c48a72a
Opcode Fuzzy Hash: 596d02146311f6e072c701cb13874d43eaf281e482e8b84d74ba7bd614a2ba36
Instruction Fuzzy Hash: 61D153F15083859BDB30DF50C849BEFBBE8EB85704F62492DE589962C1DBB09548CB63

Function 00BEAA44 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 438
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00BEAA49

Part of subcall function 00BE96EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00BE97B3

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,00BEA35C,?,00000000), ref: 00BEAB7E
GetFileAttributesW.KERNEL32(?), ref: 00BEAC38
DeleteFileW.KERNEL32(?), ref: 00BEAC46
SetWindowTextW.USER32(?,?), ref: 00BEAD8F
_wcsrchr.LIBVCRUNTIME ref: 00BEAF19
GetDlgItem.USER32(?,00000066), ref: 00BEAF54
SetWindowTextW.USER32(00000000,?), ref: 00BEAF64
SendMessageW.USER32(00000000,00000143,00000000,00C1412A), ref: 00BEAF78
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BEAFA1

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00BEAE38
, xrefs: 00BEACF2
%s.%d.tmp, xrefs: 00BEAC5E
ProgramFilesDir, xrefs: 00BEAE63

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$ $ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-312220925
Opcode ID: 1733d732ec88f70f711d5caf7106bf9b3025dd8636aa4917b9c2900e7719b5f6
Instruction ID: ba744547df0100940b117c6f203cd434d316e31312304013868a1184980823ff
Opcode Fuzzy Hash: 1733d732ec88f70f711d5caf7106bf9b3025dd8636aa4917b9c2900e7719b5f6
Instruction Fuzzy Hash: A7E12F72900259AAEF24ABA1DD85EEEB3FCEF05350F1044E6F505E3151EB749B84CB61

Function 00BDCF27 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDC8DE: _wcschr.LIBVCRUNTIME ref: 00BDC90D

GetWindowRect.USER32(?,?), ref: 00BDCF5E
GetClientRect.USER32(?,?), ref: 00BDCF6A
GetWindowLongW.USER32(?,000000F0), ref: 00BDD00B
GetWindowRect.USER32(?,?), ref: 00BDD038
GetWindowTextW.USER32(?,?,00000400), ref: 00BDD057
SetWindowTextW.USER32(?,?), ref: 00BDD07E
GetSystemMetrics.USER32(00000008), ref: 00BDD086
GetWindow.USER32(?,00000005), ref: 00BDD091
GetWindowTextW.USER32(00000000,?,00000400), ref: 00BDD0BC
SetWindowTextW.USER32(00000000,00000000), ref: 00BDD0E9
GetWindowRect.USER32(00000000,?), ref: 00BDD0FC
GetWindow.USER32(00000000,00000002), ref: 00BDD16E

Strings

d, xrefs: 00BDCF8A

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID: d
API String ID: 4134264131-2564639436
Opcode ID: 9086e9c22609dc36c3e54b4131fd3df502bcb7d77b4e987991d3d81c30d222ed
Instruction ID: dc4afe559575e266cc06cf7bae80ae0078f81f347b8b1eb4ba2621383cb811d3
Opcode Fuzzy Hash: 9086e9c22609dc36c3e54b4131fd3df502bcb7d77b4e987991d3d81c30d222ed
Instruction Fuzzy Hash: 62615BB2208301AFD310DF68CD88F6FBBEAEBC9714F05491DF68492290D674E909CB52

Function 00BEB70D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,00C28958), ref: 00BEB71C
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE9324), ref: 00BEB747
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BEB756
SendMessageW.USER32(00000000,000000C2,00000000,00C002E4), ref: 00BEB760
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BEB776
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00BEB78C
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BEB7CC
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00BEB7D6
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BEB7E5
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BEB808
SendMessageW.USER32(00000000,000000C2,00000000,00C01368), ref: 00BEB813

Strings

\, xrefs: 00BEB77C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: MessageSend$ItemShowWindow
String ID: \
API String ID: 1207805008-2967466578
Opcode ID: 23a8f8fb7aaf5279f05f464733a496faf341b244bcab9d699e8e51b2a77aeca6
Instruction ID: 9cb0e5b280f262613a8aeac7733b82486642354d1db3f1dd149aac2c68030a11
Opcode Fuzzy Hash: 23a8f8fb7aaf5279f05f464733a496faf341b244bcab9d699e8e51b2a77aeca6
Instruction Fuzzy Hash: 7E2123712857447BE311EB259C41FAF7EDCEF86714F010A18FA90961D0D7A55E08CAA7

Function 00BE8BCF Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00000066,PNG,?,?,00BE9AC7,00000066), ref: 00BE8BE0
SizeofResource.KERNEL32(00000000,75755780,?,?,00BE9AC7,00000066), ref: 00BE8BF8
LoadResource.KERNEL32(00000000,?,?,00BE9AC7,00000066), ref: 00BE8C0B
LockResource.KERNEL32(00000000,?,?,00BE9AC7,00000066), ref: 00BE8C16
GlobalAlloc.KERNEL32(00000002,00000000,00000000,?,?,?,00BE9AC7,00000066), ref: 00BE8C34
GlobalLock.KERNEL32(00000000), ref: 00BE8C41
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00BE8C61
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00BE8C9C
GlobalUnlock.KERNEL32(00000000), ref: 00BE8CB1
GlobalFree.KERNEL32(00000000), ref: 00BE8CB8

Strings

PNG, xrefs: 00BE8BD1

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: cce7da01ba37c66fe9e407b97747302bb7eecd70e6ca8a12a4516917b6ca4497
Instruction ID: d934b087b34b23d8fa26148ded5faa83d21520c5542fa0ac3223b1d8f7deec33
Opcode Fuzzy Hash: cce7da01ba37c66fe9e407b97747302bb7eecd70e6ca8a12a4516917b6ca4497
Instruction Fuzzy Hash: D6216171502B41AFC7219F22DD49B2FBBE8EF46751F224568F94A96260DF31DC00CAA1

Function 00BEB9A9 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 00BEBAD7
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 00BEBB1C
GetExitCodeProcess.KERNEL32(?,?), ref: 00BEBB54
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BEBB7A
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 00BEBC09

Part of subcall function 00BE0B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BDAC99,?,?,?,00BDAC48,?,-00000002,?,00000000,?), ref: 00BE0B16

Strings

.inf, xrefs: 00BEBA93
.exe, xrefs: 00BEBB84
, xrefs: 00BEBA29

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 638256189532efe0e3958d2f48e2eb1bb6139887441d3dff9545187277b7cdc3
Instruction ID: 038eca27e60504ecc2279945ee521f5bddfae30c78bd29d7785e529c1da862dd
Opcode Fuzzy Hash: 638256189532efe0e3958d2f48e2eb1bb6139887441d3dff9545187277b7cdc3
Instruction Fuzzy Hash: 1451E2315093C09ADB31AF22D950FBFB7E9EF85704F0408ADE5C293194EBB18988CB52

Function 00BDCB1C Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00BDCB21
_wcschr.LIBVCRUNTIME ref: 00BDCB3F
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00BDCB03,?), ref: 00BDCB5A

Part of subcall function 00BE06D7: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00BDB2AB,00000000,?,?,?,?), ref: 00BE06F3

Strings

*messages***, xrefs: 00BDCC5F
*messages***, xrefs: 00BDCC26
a, xrefs: 00BDCC7B
R, xrefs: 00BDCC71

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide_wcschr
String ID: *messages***$*messages***$R$a
API String ID: 803915177-2900423073
Opcode ID: 70349fc4986f2f334fd52f371ecd004448e86ce2c1fe225768a7608e30e6f9f4
Instruction ID: f60df64033b7639aac0343772cb2f8bfab355edc582b22aaa77d8c9e41bab3c8
Opcode Fuzzy Hash: 70349fc4986f2f334fd52f371ecd004448e86ce2c1fe225768a7608e30e6f9f4
Instruction Fuzzy Hash: 6291E5B290020A9ADB30DF64CC55BAAFFE5EF54300F1445FBE649A7391FA709984CB94

Function 00BF739F Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BF2FB2,00BF2FB2,?,?,?,00BF75F0,00000001,00000001,F5E85006), ref: 00BF73F9
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BF75F0,00000001,00000001,F5E85006,?,?,?), ref: 00BF747F
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BF7579
__freea.LIBCMT ref: 00BF7586

Part of subcall function 00BF59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF239A,?,0000015D,?,?,?,?,00BF2F19,000000FF,00000000,?,?), ref: 00BF5A1E

__freea.LIBCMT ref: 00BF758F
__freea.LIBCMT ref: 00BF75B4

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: fdd2c6d3877fa5876a3a6c777a0b8543e76f9bb6927f4fda7e0ebc4809def12e
Instruction ID: 0bb56e218ac8e414c1f8c8488f74091a473a95cdcf416fe18915b3b02ba2bfdf
Opcode Fuzzy Hash: fdd2c6d3877fa5876a3a6c777a0b8543e76f9bb6927f4fda7e0ebc4809def12e
Instruction Fuzzy Hash: 8651CF7264421AABDB258F64CC81EBF7AE9EB54750F2546E8FE04D7140EF34DC48C6A0

Function 00BE8FC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00BE8FDE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00BE9015

Part of subcall function 00BE0B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BDAC99,?,?,?,00BDAC48,?,-00000002,?,00000000,?), ref: 00BE0B16

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00BE9005

Strings

@UJu, xrefs: 00BE9015
EDIT, xrefs: 00BE8FE9, 00BE8FF4, 00BE9001

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: f5b396c61085e1ed4c5f317ea19246638f7d372ab20702d30d34857d0ba733ed
Instruction ID: ae968bfb24c121d1e329ec1d4c8a986da649acb5bcdb06dfd836096ac3fdd22d
Opcode Fuzzy Hash: f5b396c61085e1ed4c5f317ea19246638f7d372ab20702d30d34857d0ba733ed
Instruction Fuzzy Hash: 96F08232B017287BEB3056669C09FDF76ACEF4AB11F4504A5BE01E21C1D7A09945CAF6

Function 00BDDF05 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDF35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BDF376
Part of subcall function 00BDF35B: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00BDDF18,Crypt32.dll,?,00BDDF9C,?,00BDDF7E,?,?,?,?), ref: 00BDF398

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BDDF24
GetProcAddress.KERNEL32(00C11E58,CryptUnprotectMemory), ref: 00BDDF34

Strings

CryptUnprotectMemory, xrefs: 00BDDF2A
CryptProtectMemory, xrefs: 00BDDF1E
Crypt32.dll, xrefs: 00BDDF0E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 93be5b1f8b396f52ba08b960cd540d3c5102df04fc817b6644aa6351142219eb
Instruction ID: 7ff1e207894061c6c91abbfe8a3fd46bbc7fefdaa0d70a0b0377ecd9d83149f2
Opcode Fuzzy Hash: 93be5b1f8b396f52ba08b960cd540d3c5102df04fc817b6644aa6351142219eb
Instruction Fuzzy Hash: B1E04FB0504B43AEDB405B349848B04FFA5BB90714F2681A6F49AC2280EFB5D0A4CB50

Function 00BDFA23 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDFDB7: ResetEvent.KERNEL32(?,00DD4050,00BDFA45,00C11E74,00DD4050,?,-00000001,00BFF605,000000FF,?,00BDFC7B,?,?,00BDA5F0,?), ref: 00BDFDD7
Part of subcall function 00BDFDB7: ReleaseSemaphore.KERNEL32(?,?,00000000,?,-00000001,00BFF605,000000FF,?,00BDFC7B,?,?,00BDA5F0,?), ref: 00BDFDEB

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00BDFA57
CloseHandle.KERNEL32(00DD4054), ref: 00BDFA71
DeleteCriticalSection.KERNEL32(00DD41F0), ref: 00BDFA8A
CloseHandle.KERNEL32(?), ref: 00BDFA96
CloseHandle.KERNEL32(?), ref: 00BDFAA2

Part of subcall function 00BDFB19: WaitForSingleObject.KERNEL32(?,000000FF,00BDFCF9,?,?,00BDFD6E,?,?,?,?,?,00BDFD58), ref: 00BDFB1F
Part of subcall function 00BDFB19: GetLastError.KERNEL32(?,?,00BDFD6E,?,?,?,?,?,00BDFD58), ref: 00BDFB2B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 7ba5cd570891efb53228e4bf3d0900047365961462dfb03d2bd4d98b04d42da5
Instruction ID: aaeea4cedeb2f7ef5dcabf26fd08b7ff7e725e472b04d6493de2c59488bc3f46
Opcode Fuzzy Hash: 7ba5cd570891efb53228e4bf3d0900047365961462dfb03d2bd4d98b04d42da5
Instruction Fuzzy Hash: B2018C32004A44EBCB219B68DD48BDABBEAFB45B14F11456AF29B92661DB712800CB60

Function 00BE9035 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BDF35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BDF376
Part of subcall function 00BDF35B: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00BDDF18,Crypt32.dll,?,00BDDF9C,?,00BDDF7E,?,?,?,?), ref: 00BDF398

OleInitialize.OLE32(00000000), ref: 00BE904E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BE9085
SHGetMalloc.SHELL32(00C120E8), ref: 00BE908F

Strings

riched20.dll, xrefs: 00BE903D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 3409eacbd83b67f3db70b4111751f9339729c5d124ef23276cfadfe7ec91b6cf
Instruction ID: a836e2dac90fcdadb6925fa5dea5f3f400388a562a1f70bedae1594408034ff4
Opcode Fuzzy Hash: 3409eacbd83b67f3db70b4111751f9339729c5d124ef23276cfadfe7ec91b6cf
Instruction Fuzzy Hash: 90F0FFB5D00209ABC710AF9ADC49AEEFFFCEF84711F00416AE815E2250D7B85645CFA1

Function 00BEBE09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00BEBE1F
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BEBE5B

Strings

sfxcmd, xrefs: 00BEBE1A
sfxpar, xrefs: 00BEBE56

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 37792b329d02968575a9005d7a0352fd8e4ce71e6b1f800adc3cda413cdbcff5
Instruction ID: f25ed7d20ee8c0b1ad6a50f7bdbb4cab2ac76d25e51213f741b6582771c3fff1
Opcode Fuzzy Hash: 37792b329d02968575a9005d7a0352fd8e4ce71e6b1f800adc3cda413cdbcff5
Instruction Fuzzy Hash: 8CF0A772401265AAD7252BD29C09FFBBBD8DF04B42F0500A6FD4856252EB648840C6A1

Function 00BD978D Relevance: 6.1, APIs: 4, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00000000,00000003,-00000001,00000000,?,00000000,?,?,00BD777A,?,00000005,?,00000011), ref: 00BD980D
GetLastError.KERNEL32(?,?,00BD777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD981A
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,00BD777A,?,00000005,?), ref: 00BD984F
GetLastError.KERNEL32(?,?,00BD777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD9857

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 036fe4c3a2c07d2f91ea1480115eda851526204f2f75ead86d65917bea42af51
Instruction ID: 5fe3574a0924882ec99f2d0baa162656591d1da36219f28b1ec8b1c19fb6c8ad
Opcode Fuzzy Hash: 036fe4c3a2c07d2f91ea1480115eda851526204f2f75ead86d65917bea42af51
Instruction Fuzzy Hash: D43134718407556BD3209F24CC45BEAFAE4FB49368F10472AF9A0873D1E3769888DB90

Function 00BD9663 Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00BD9673
ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 00BD968B
GetLastError.KERNEL32 ref: 00BD96BD
GetLastError.KERNEL32 ref: 00BD96DC

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 7186ddb2cf9f00119e9ddf3115435ba9c09f5842a7e4fb112c8b26d71655555c
Instruction ID: 7696d067a57f6687ee845199c8501ff213600fb0bbe96f24b43ecf59136b2ae8
Opcode Fuzzy Hash: 7186ddb2cf9f00119e9ddf3115435ba9c09f5842a7e4fb112c8b26d71655555c
Instruction Fuzzy Hash: EE113974900214EBDF20AF60C984B6ABBEDEB15325F10C5ABF96A86390E735CD40DF52

Function 00BF77C2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BF2203,00000000,00000000,?,00BF7769,00BF2203,00000000,00000000,00000000,?,00BF7966,00000006,FlsSetValue), ref: 00BF77F4
GetLastError.KERNEL32(?,00BF7769,00BF2203,00000000,00000000,00000000,?,00BF7966,00000006,FlsSetValue,00C03768,00C03770,00000000,00000364,?,00BF63E0), ref: 00BF7800
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BF7769,00BF2203,00000000,00000000,00000000,?,00BF7966,00000006,FlsSetValue,00C03768,00C03770,00000000), ref: 00BF780E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 8d878c3a5521ac0f61af678c21437e7654138e4e6d22e9c4575bd06bf862b5e4
Instruction ID: 616c452b4ca80a0c72b4524de5ff8811e0c26064283f99ef1b0e288c8eeb6bf7
Opcode Fuzzy Hash: 8d878c3a5521ac0f61af678c21437e7654138e4e6d22e9c4575bd06bf862b5e4
Instruction Fuzzy Hash: 9D01AC326952269BC7614A6A9C48F7E77D8EF15BE1F2205A0FB06D7140DF20DC15C7E0

Function 00BE991D Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BE992E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BE993F
TranslateMessage.USER32(?), ref: 00BE9949
DispatchMessageW.USER32(?), ref: 00BE9953

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 8325ef9b5cd55660924dafdc35f23451ae61ebffba363e2ebcdcd0362b1b363d
Instruction ID: 0fbda4c46625794d58ef2989062da610024222f09b06354d6188c848c73f0c21
Opcode Fuzzy Hash: 8325ef9b5cd55660924dafdc35f23451ae61ebffba363e2ebcdcd0362b1b363d
Instruction Fuzzy Hash: B5E0ED72D0222EA7CB20ABE6AC4CFDF7F6CEE0A2657014055B519D2000D6689505CBF1

Function 00BDDF86 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BDDF05: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BDDF24
Part of subcall function 00BDDF05: GetProcAddress.KERNEL32(00C11E58,CryptUnprotectMemory), ref: 00BDDF34

GetCurrentProcessId.KERNEL32(?,?,?,00BDDF7E), ref: 00BDE007

Strings

CryptProtectMemory failed, xrefs: 00BDDFC7
CryptUnprotectMemory failed, xrefs: 00BDDFFF

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 91ba6a7a4f1b7d98e47c7497cb1984a607175e2eb3093092c8474d06af03ed57
Instruction ID: 5293dd253a88e079c86f304fcea74b5e6ecbaba0db62aea4e5fca49cb023a324
Opcode Fuzzy Hash: 91ba6a7a4f1b7d98e47c7497cb1984a607175e2eb3093092c8474d06af03ed57
Instruction Fuzzy Hash: 061138303042016BDB25AB28DC52B6EB7DAEF85754F0840ABF9118B291FBA0EC01C290

Function 00BDFBBD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,Function_0000FD4F,?,00000000,00000000), ref: 00BDFBE1
SetThreadPriority.KERNEL32(?,00000000), ref: 00BDFC28

Part of subcall function 00BD6D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD6DAD

Strings

CreateThread failed, xrefs: 00BDFBED

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 45c71d109cd58449e87077abbe019ac4bc659b384f23858dcab17134e1b57255
Instruction ID: ec5b98732ccac0e8329fd205297ad710b200292f3650075a66f1d4799580328a
Opcode Fuzzy Hash: 45c71d109cd58449e87077abbe019ac4bc659b384f23858dcab17134e1b57255
Instruction Fuzzy Hash: 4401D67534830A6BD2246F68AC86F76B3D9EB41755F24057FFA42962C0EAA16841C770

Function 00BD9C18 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00BDC8A3,00000001,?,?,?,00000000,00BE420A,?,?,?,?,?,00BE3CAF), ref: 00BD9C33
WriteFile.KERNEL32(?,00000000,?,00BE3EB7,00000000,?,?,00000000,00BE420A,?,?,?,?,?,00BE3CAF,?), ref: 00BD9C73
WriteFile.KERNEL32(?,00000000,?,00BE3EB7,00000000,?,00000001,?,?,00BDC8A3,00000001,?,?,?,00000000,00BE420A), ref: 00BD9CA0

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 78da0ecc5fa8a28a02e42a4570a32622398a90e345b8af0527246d6cedcb7b6d
Instruction ID: e8329ee00f9b0b0fdd9c93ea532b19bc4e01d7a9486d936c1f8a5331fd72c444
Opcode Fuzzy Hash: 78da0ecc5fa8a28a02e42a4570a32622398a90e345b8af0527246d6cedcb7b6d
Instruction Fuzzy Hash: A9315472158609AFDB209F14DC48BAAFBE9FB51300F18426BF595933C0E774E848CBA1

Function 00BD9ED6 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BD9EFD
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BD9F30
GetLastError.KERNEL32(?,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BD9F4D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 9628550a965f47a0bf60df5b47e0d2a2db7c332add644028acd0e6036e0ee1d2
Instruction ID: eae90cb9b12c324da306b4c1806953b5363681286eb9252e043db015a6a31511
Opcode Fuzzy Hash: 9628550a965f47a0bf60df5b47e0d2a2db7c332add644028acd0e6036e0ee1d2
Instruction Fuzzy Hash: 9B01B132104259A6EB21AB644C86FFEB7DCDF06B41F1844D3F845E6281FB64F980D7A1

Function 00BD3A90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD3A95

Strings

CMT, xrefs: 00BD3AA4

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 76b2b7ab3ac8833944eadb160bf26eb0b7f7505ce90f42e08e4cda35ac02afc8
Instruction ID: ab0f500f547ebe2982dad96649ffed7e26fb3ebe249d31d88ab7ff24196f53b8
Opcode Fuzzy Hash: 76b2b7ab3ac8833944eadb160bf26eb0b7f7505ce90f42e08e4cda35ac02afc8
Instruction Fuzzy Hash: 68619F71505F44AADB21DB34CC81AE7FBE8EB14701F4449AFE5AB87242E7326A48CF51

Function 00BF82B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00BF82D9

Strings

, xrefs: 00BF831E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 244fabd0d1fdc34eb553694629f1a59cc59046eb98ffa58b398659a7f4266eb1
Instruction ID: 63f7485cf67dd3124e2e102f8dd85809829ae7f18f9803ba96cb9164b5c4bb1e
Opcode Fuzzy Hash: 244fabd0d1fdc34eb553694629f1a59cc59046eb98ffa58b398659a7f4266eb1
Instruction Fuzzy Hash: F3411B7050838C9BDF228F288C84BFABBF9EB55704F1404EDE68A87152D635A949DF64

Function 00BD1DD2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD1DD7

Part of subcall function 00BD3A90: __EH_prolog.LIBCMT ref: 00BD3A95

Strings

CMT, xrefs: 00BD1E0D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 44281cc2feb1ac09648eedb56c3219b527c8a577d0157d248ae2092ceb0bdaa5
Instruction ID: c6afe2b6655697a643c0a84033a98f6bac574e23b42a44eed5966ab04d05f520
Opcode Fuzzy Hash: 44281cc2feb1ac09648eedb56c3219b527c8a577d0157d248ae2092ceb0bdaa5
Instruction Fuzzy Hash: 00216876900209AFCB11EF98C9419EEFBF6FF58300F1005AAE845A3252DB326E51DB60

Function 00BD192C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD192C

Strings

CMT, xrefs: 00BD19A5

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 198ff32032b46a27270afcebd75478c9bedc64ddd37f9f29589fe886b77d616e
Instruction ID: 9ab83e6bbb18fb22b4959a9a4f2f45dc3b3b373e215b1ba201d0c51505963e6b
Opcode Fuzzy Hash: 198ff32032b46a27270afcebd75478c9bedc64ddd37f9f29589fe886b77d616e
Instruction Fuzzy Hash: 0D11D671A00205BFCB04DF69C4A19BEF7EAFF44300F0448ABE84597341EB359852DB50

Function 00BF79FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F5E85006,00000001,?,000000FF), ref: 00BF7A6B

Strings

LCMapStringEx, xrefs: 00BF7A0B, 00BF7A15

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: d225d0763d81ad1eb8c72f4851bf43848d4c494e0afcb2f2110cbd8f9247e4a3
Instruction ID: b762a8351bf388992e1d1ef5b6cd6a578bdf4c44b07d845ae9cb94a2becfdad4
Opcode Fuzzy Hash: d225d0763d81ad1eb8c72f4851bf43848d4c494e0afcb2f2110cbd8f9247e4a3
Instruction Fuzzy Hash: AC01487654020DBBCF02AF94DD45EEE7FA6EF08750F124195FE1826160DA72CA31EB80

Function 00BF7998 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00BF708B), ref: 00BF79E3

Strings

InitializeCriticalSectionEx, xrefs: 00BF79B3

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 9144a7cf6fa0e00d245d7280042604fd8ffc3b7aede0a4d9dd42d30f3384a27a
Instruction ID: c45f7c7bf895746bc3bd68fbb5959589752426383b12249177d51bc36fcff850
Opcode Fuzzy Hash: 9144a7cf6fa0e00d245d7280042604fd8ffc3b7aede0a4d9dd42d30f3384a27a
Instruction Fuzzy Hash: DBF0B47568521CBBCF016F55DD05EAEBFA5DB04720F1141A5FD1457160DEB14E10DBD0

Function 00BF783D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00BF787C

Strings

FlsAlloc, xrefs: 00BF7858

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 855e7f823cfc057310fc7b8ee353f9cb08842c1bd165744436195b7715c5fdca
Instruction ID: 1a38c526bf6053c07f512b460d3e2730eeb38dd50aa7a8beb2becb199262b5a4
Opcode Fuzzy Hash: 855e7f823cfc057310fc7b8ee353f9cb08842c1bd165744436195b7715c5fdca
Instruction Fuzzy Hash: ECE0E570B85318BBC704BB65AD4AB7EBBD8CB44B60F5200E9FE0567280DEB14E00C6D5

Function 00BF1D87 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00BF1D9C

Strings

FlsAlloc, xrefs: 00BF1D8B, 00BF1D95

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 9d8c15ea424a82051de58a305bf3f26402b8b97556e4947b514e89c2f3f4e77a
Instruction ID: e972c547d9c84d62c3bef6bdc27a03b4e151ca63c56beaeb3b7a8318616d1a9d
Opcode Fuzzy Hash: 9d8c15ea424a82051de58a305bf3f26402b8b97556e4947b514e89c2f3f4e77a
Instruction Fuzzy Hash: 3AD01235B8222866D51077959C02AADBAC4CA00BB1F4904B1FF086628197914950E5D1

Function 00BD6551 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00BD65A5
_strlen.LIBCMT ref: 00BD6600

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _memcmp_strlen
String ID:
API String ID: 2682527083-0
Opcode ID: 34014315e53433bc50b9aca7c081bf968f22ce7fbf4c8ab8bd2f833f69c526e1
Instruction ID: 4a4f6a5d058b69acf667e1a5f09a8f29183fba7282577ab11a1b75cc9b3b14ae
Opcode Fuzzy Hash: 34014315e53433bc50b9aca7c081bf968f22ce7fbf4c8ab8bd2f833f69c526e1
Instruction Fuzzy Hash: F951C6B2504348ABD720EF60DC89FDBB3ECEB88304F04096AF989D7156EA75E544C7A1

Function 00BF8609 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00BF81DC: GetOEMCP.KERNEL32(00000000,?,?,00BF8465,?), ref: 00BF8207

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00BF84AA,?,00000000), ref: 00BF867D
GetCPInfo.KERNEL32(00000000,00BF84AA,?,?,?,00BF84AA,?,00000000), ref: 00BF8690

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a9f5ead2a00322cb1049519bea9e03f1081d695bb2ad86dda8f9f11cfd25a2cd
Instruction ID: c5ae93c0e14d15add6dfe9e06d9dd34b3f20b9f89578d008205edee17ac571b1
Opcode Fuzzy Hash: a9f5ead2a00322cb1049519bea9e03f1081d695bb2ad86dda8f9f11cfd25a2cd
Instruction Fuzzy Hash: A1513470A003099EDB25AF71C8857BBBBE5EF41310F2440AED2868B251EF74DD4ACB91

Function 00BD13B4 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD13B4

Part of subcall function 00BD5F9E: __EH_prolog.LIBCMT ref: 00BD5FA3

Part of subcall function 00BDC463: __EH_prolog.LIBCMT ref: 00BDC468
Part of subcall function 00BDC463: new.LIBCMT ref: 00BDC4AB
Part of subcall function 00BDC463: new.LIBCMT ref: 00BDC4CF

new.LIBCMT ref: 00BD142C

Part of subcall function 00BDACB6: __EH_prolog.LIBCMT ref: 00BDACBB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bd0ddef05e7d35735cd7469fe0da24301da50f6633848eec413c6a8e256611a0
Instruction ID: cac3efecf01566badf04e1e3ffbc1b4c5f90dd5b0acd7555cdd0e968e83f83b4
Opcode Fuzzy Hash: bd0ddef05e7d35735cd7469fe0da24301da50f6633848eec413c6a8e256611a0
Instruction Fuzzy Hash: E94114B0805B40DED720CF798895AE6FBE5FB28310F5049AEE5EE87382DB726554CB11

Function 00BD13AF Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD13B4

Part of subcall function 00BD5F9E: __EH_prolog.LIBCMT ref: 00BD5FA3

Part of subcall function 00BDC463: __EH_prolog.LIBCMT ref: 00BDC468
Part of subcall function 00BDC463: new.LIBCMT ref: 00BDC4AB
Part of subcall function 00BDC463: new.LIBCMT ref: 00BDC4CF

new.LIBCMT ref: 00BD142C

Part of subcall function 00BDACB6: __EH_prolog.LIBCMT ref: 00BDACBB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b1ee8fa8b789121efd69932af227f0cb287d9db68901eedeb12f9a56632174fc
Instruction ID: edcbfc3b9627efd01da26e6e6d0c1dba84093ae6fa32e49555a14d6e81abcd87
Opcode Fuzzy Hash: b1ee8fa8b789121efd69932af227f0cb287d9db68901eedeb12f9a56632174fc
Instruction Fuzzy Hash: 944125B0805B40DED720CF798485AE6FBE5FF28300F5049AED5EE83282DB726554CB11

Function 00BF8448 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00BF630E: GetLastError.KERNEL32(?,00C0CBE8,00BF2664,00C0CBE8,?,?,00BF2203,?,?,00C0CBE8), ref: 00BF6312
Part of subcall function 00BF630E: _free.LIBCMT ref: 00BF6345
Part of subcall function 00BF630E: SetLastError.KERNEL32(00000000,?,00C0CBE8), ref: 00BF6386
Part of subcall function 00BF630E: _abort.LIBCMT ref: 00BF638C

Part of subcall function 00BF8567: _abort.LIBCMT ref: 00BF8599
Part of subcall function 00BF8567: _free.LIBCMT ref: 00BF85CD

Part of subcall function 00BF81DC: GetOEMCP.KERNEL32(00000000,?,?,00BF8465,?), ref: 00BF8207

_free.LIBCMT ref: 00BF84C0
_free.LIBCMT ref: 00BF84F6

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: faa6a9a374a1663b2d9349f5664b26625137cd59db67b0260d6c293781ac3d8c
Instruction ID: 394bdc647a0195bc805f9fd14a246c0e9346376625bf2882f36ab9416d4a8ccc
Opcode Fuzzy Hash: faa6a9a374a1663b2d9349f5664b26625137cd59db67b0260d6c293781ac3d8c
Instruction Fuzzy Hash: 6D316D3190420DAFDB24EBA8D441BBD77E5EF41320F2541D9EA049B3A1EF769E48CB50

Function 00BD9541 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00BD9BD7,?,?,00BD7735), ref: 00BD95C9
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00BD9BD7,?,?,00BD7735), ref: 00BD95FE

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 40971719a6aa629204e31b65095f8a21968346a14ed628bb2d8955311a7ddbf9
Instruction ID: 4e92c7d444496c92d2eada7d454bd8ddee66887ed658949bc1d3c8d6015262f6
Opcode Fuzzy Hash: 40971719a6aa629204e31b65095f8a21968346a14ed628bb2d8955311a7ddbf9
Instruction Fuzzy Hash: 4F2128B1404348AFE3308F64DC85BA7BBE8EB15768F004A6EF1E5822D1D374AC498B61

Function 00BD9A62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00BD7436,?,?,?), ref: 00BD9A7C
SetFileTime.KERNEL32(?,?,?,?), ref: 00BD9B2C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 33e9aa85779a989ce7280fc273ac145d7fecce5f980ccfe31e3a8a26e7762c79
Instruction ID: 2ade607958f4f0f372ffc3026284be6e12f7652597cc96c5bb2142d669f2401b
Opcode Fuzzy Hash: 33e9aa85779a989ce7280fc273ac145d7fecce5f980ccfe31e3a8a26e7762c79
Instruction Fuzzy Hash: 0221B432259386ABC714DF24C491ABAFBD4EB96704F48099EF8D587341E329DD48C751

Function 00BF7726 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00BF7786
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BF7793

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: aea7436767c109e9dd4976dd4d950ff4f0a4ec84ab720dc261d9b61483c64a29
Instruction ID: 1369990f44a8efe192552ae4b721dbcaa5905e4e0e18b8fe743e68a4af4c87fb
Opcode Fuzzy Hash: aea7436767c109e9dd4976dd4d950ff4f0a4ec84ab720dc261d9b61483c64a29
Instruction Fuzzy Hash: 9D1127376542289BEB21AE2CDC80A7E73D5EB84720B1642E0EE14AB254DF31DC0587D1

Function 00BD9B3B Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00BD9B71
GetLastError.KERNEL32 ref: 00BD9B7D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1965aba8aaecbd0a3f1d79d658d62b8bf598bb2110320fb8f6dddaede7e352c2
Instruction ID: 7fb7efa8b3447f177599e5cf2805b5dc6b26e7f714aa7a8290e3329b6d4afbdd
Opcode Fuzzy Hash: 1965aba8aaecbd0a3f1d79d658d62b8bf598bb2110320fb8f6dddaede7e352c2
Instruction Fuzzy Hash: 7D018C707006046BDB349A69EC84B6AF7D9EB84319F164ABFB152C2780EA75D808C621

Function 00BD98E7 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?), ref: 00BD993B
GetLastError.KERNEL32 ref: 00BD9948

Part of subcall function 00BD96FA: __EH_prolog.LIBCMT ref: 00BD96FF

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 6646346805b300480cfed5075feb6e5df06503b0d8df04d61fbbdd2dce02f708
Instruction ID: 6e13258255a1d122cdf26f6372c4e8529f727b61e93e47fe23c4e7ed790061a4
Opcode Fuzzy Hash: 6646346805b300480cfed5075feb6e5df06503b0d8df04d61fbbdd2dce02f708
Instruction Fuzzy Hash: 4C01B5322011059B8F188E599CA87AFB7D9FF5132071542AFF929DB394F734EC019760

Function 00BF5ADA Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF5AFB

Part of subcall function 00BF59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF239A,?,0000015D,?,?,?,?,00BF2F19,000000FF,00000000,?,?), ref: 00BF5A1E

RtlReAllocateHeap.NTDLL(00000000,?,00200000,?,?,00C0CBE8,00BD17D2,?,?,?,?,00000000,?,00BD13A9,?,?), ref: 00BF5B37

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 730e67350465082474aad92be049b8d8131e4e8a9c36e7951af67db93bcfe89a
Instruction ID: a4581f92c90138d1787439e4a018c0598e2f01321fcc7b2e1335f33c1b6ac0e3
Opcode Fuzzy Hash: 730e67350465082474aad92be049b8d8131e4e8a9c36e7951af67db93bcfe89a
Instruction Fuzzy Hash: 94F0C231611D1D6ADB312E25AC41F7B37DCCF82771B114199FB14971A2EA309D098170

Function 00BDFC94 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00BDFCA1
GetProcessAffinityMask.KERNEL32(00000000), ref: 00BDFCA8

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: ffe5491db238452a780cd04bad008b3de945ae07a243f39f9ed4cb486712c3b7
Instruction ID: f4ce1d89f9591ef8c4e1070e827e27c6653830bfc879410670958e4fdb0cc67b
Opcode Fuzzy Hash: ffe5491db238452a780cd04bad008b3de945ae07a243f39f9ed4cb486712c3b7
Instruction Fuzzy Hash: 11E06D36A6810F678B0886A89C05ABFB2EDDB14205B2945BBAC0BD3304F924DD5146A4

Function 00BF4E74 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00BF89A0: GetEnvironmentStringsW.KERNEL32 ref: 00BF89A9
Part of subcall function 00BF89A0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BF89CC
Part of subcall function 00BF89A0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BF89F2
Part of subcall function 00BF89A0: _free.LIBCMT ref: 00BF8A05
Part of subcall function 00BF89A0: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BF8A14

_free.LIBCMT ref: 00BF4EBA
_free.LIBCMT ref: 00BF4EC1

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 400815659-0
Opcode ID: b5f041d931675e9191987ac63c13767a94993f6966c6c104895b412ce1f9beb2
Instruction ID: 51e61f4e98a97e0dc7ae0bb59ab1e9d2c9ad81b53d2c8a308781049183adbbb0
Opcode Fuzzy Hash: b5f041d931675e9191987ac63c13767a94993f6966c6c104895b412ce1f9beb2
Instruction Fuzzy Hash: 4BE0E532A4681993AB39B2793C02A3B01C5ABC1334B1203D6FB20872D2CF90880E4197

Function 00BDA113 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,00000001,?,00BD9F49,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BDA127
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BD9F49,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BDA158

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f2b86dd36598198b982144bde457932171e6230218e1071ca741fad2f7b16399
Instruction ID: 13197253b53cc650450fab5e0fce607c7d03dff46b855c1d38abab6f5b11f6bf
Opcode Fuzzy Hash: f2b86dd36598198b982144bde457932171e6230218e1071ca741fad2f7b16399
Instruction Fuzzy Hash: 71F03031240109ABDF115F60DC41BEF7BADEF05786F448092B988D6160EB36DA99DB50

Function 00BEC0CF Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BEC0FD
SetDlgItemTextW.USER32(00000065,?), ref: 00BEC114

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: b4dac7a81c663ef0b29be537bb394ae7926a50da2493a0f413dc69b845e1b1b1
Instruction ID: 4f94fe0e7f7e54876dbaca80c8eb80c18f8c0e869dc87c89288701b42e157df4
Opcode Fuzzy Hash: b4dac7a81c663ef0b29be537bb394ae7926a50da2493a0f413dc69b845e1b1b1
Instruction Fuzzy Hash: 18F0EC76540388BBEB21A7618C06FEE3B9DEB04741F0444D6F605931E3E7715A31D7A2

Function 00BD9DFC Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00BD9661,?,?,00BD94BC), ref: 00BD9E0D
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00BD9661,?,?,00BD94BC), ref: 00BD9E3B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: fe197e1d06fb6542903491df385d15a2a2d0fc2dae2653a8e1d1615a4557aa6d
Instruction ID: 1425b468e846974930bf3d63d779e9109deb043aeef0e39c481b7deed758abe0
Opcode Fuzzy Hash: fe197e1d06fb6542903491df385d15a2a2d0fc2dae2653a8e1d1615a4557aa6d
Instruction Fuzzy Hash: 46E09231640249ABDB119F61DC41FEEB7DDEF08781F8440A2BA88C2150EB31DD94DA90

Function 00BD9E63 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,00BD9E58,?,00BD75A0,?,?,?,?), ref: 00BD9E74
GetFileAttributesW.KERNEL32(?,?,?,00000800,?,00BD9E58,?,00BD75A0,?,?,?,?), ref: 00BD9EA0

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a289524e69baae3ebaf337c4d1322f07ce3b91723623d5c2ded19c9d0699bcbb
Instruction ID: 25fe56ad0867550fe7501329a86ce977ce4f63dc2911fd52ed7c092e422c9536
Opcode Fuzzy Hash: a289524e69baae3ebaf337c4d1322f07ce3b91723623d5c2ded19c9d0699bcbb
Instruction Fuzzy Hash: 1AE09B325001585BCB10AB68DC05BEABB9CDB083E2F0141E1FD58E3290DB719D9987D0

Function 00BDF35B Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BDF376
LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,00BDDF18,Crypt32.dll,?,00BDDF9C,?,00BDDF7E,?,?,?,?), ref: 00BDF398

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 5c6d9e83486d3bbb40657c885f6570c8da1842e12e57d2fe5212c9f2a99dc6af
Instruction ID: 5e0b2b57f688280aa3b06961bbebe758025d469f5b3f4a6b7053c91ed09b1684
Opcode Fuzzy Hash: 5c6d9e83486d3bbb40657c885f6570c8da1842e12e57d2fe5212c9f2a99dc6af
Instruction Fuzzy Hash: D3E0127281015CA7DB119BA49C05FEAB7ACEB09391F4540A6B948D2105DB749A90CBB5

Function 00BE8923 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BE8944
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00BE894B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 956e45bb4f2cc644fa353c467dc449006290d45cab8a37d014cc07ab3ae08d2d
Instruction ID: daf1b107a22c653c1e9bb31c05779cca84f37b292a7c614a977578c5e466db65
Opcode Fuzzy Hash: 956e45bb4f2cc644fa353c467dc449006290d45cab8a37d014cc07ab3ae08d2d
Instruction Fuzzy Hash: ABE06D75800208EFCB20DF9AC9017E9BBE8EB04321F1080AAE84893601D7B16E00EB92

Function 00BE909D Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,00BFF605,000000FF), ref: 00BE90C6
CoUninitialize.COMBASE(?,?,?,00BFF605,000000FF), ref: 00BE90CB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 72e664810d61a7f6b3d598a6be80ac2784cb734aae11a4a023d5bbd337eb68b7
Instruction ID: 549f85ff49747c7b009a9ca3f4336a45831e46a45a6ba23a36523b7631201267
Opcode Fuzzy Hash: 72e664810d61a7f6b3d598a6be80ac2784cb734aae11a4a023d5bbd337eb68b7
Instruction Fuzzy Hash: 2AE01A36548644EFC311DB48DD05B59BBE9FB09B20F1087A9B91A83B60DB396844CA95

Function 00BF0C46 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 00BF1D87: try_get_function.LIBVCRUNTIME ref: 00BF1D9C

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BF0C64
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00BF0C6F

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 11d0914929f0695b6efd23f737fe8b28a967595f4b637bf36efa112ee7028163
Instruction ID: 3d780aa05d9b91d675ed5caf8d785346982d97fbffc7cd2ec8f68c5a2272413f
Opcode Fuzzy Hash: 11d0914929f0695b6efd23f737fe8b28a967595f4b637bf36efa112ee7028163
Instruction Fuzzy Hash: A2D022BC2B830EC8AC0476B8B80257E17C0C9127B47701BD6E720CB4F3EE22804EA416

Function 00BD12C2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00BD12D7
ShowWindow.USER32(00000000), ref: 00BD12DE

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: ffd23ba48d05e21f6570202b064970fc40d4b6ab4af7ee2e9ec9b02999ce59cf
Instruction ID: 01730cd659c11267f72fab1a0053990ee1259b1e681a6e9f6b87bdb8b8ba084a
Opcode Fuzzy Hash: ffd23ba48d05e21f6570202b064970fc40d4b6ab4af7ee2e9ec9b02999ce59cf
Instruction Fuzzy Hash: B4C01232058200BFCB010BB0DC09F2EBFAAABA5212F02C908B4A5C00A0C238C020DB12

Function 00BDFC3C Relevance: 2.5, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C11E74,?,?,00BDA5F0,?,?,?,?,00BFF605,000000FF), ref: 00BDFC4B
LeaveCriticalSection.KERNEL32(00C11E74,?,?,00BDA5F0,?,?,?,?,00BFF605,000000FF), ref: 00BDFC89

Part of subcall function 00BDFA23: ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 00BDFA57
Part of subcall function 00BDFA23: CloseHandle.KERNEL32(00DD4054), ref: 00BDFA71
Part of subcall function 00BDFA23: DeleteCriticalSection.KERNEL32(00DD41F0), ref: 00BDFA8A
Part of subcall function 00BDFA23: CloseHandle.KERNEL32(?), ref: 00BDFA96
Part of subcall function 00BDFA23: CloseHandle.KERNEL32(?), ref: 00BDFAA2

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterLeaveReleaseSemaphore
String ID:
API String ID: 3265325312-0
Opcode ID: 72a9b6e4da486be408fafe904fe8eeb2364a277f0c534b7f06edaf3cb498295f
Instruction ID: 3b1ddf8d043fdcc0e07e6b0281a5a19475f04b93c7a622a9b1bc485135efec83
Opcode Fuzzy Hash: 72a9b6e4da486be408fafe904fe8eeb2364a277f0c534b7f06edaf3cb498295f
Instruction Fuzzy Hash: 74F02731108211A7C3254710EC08BBEBAE4EF46B15F0DC07BFD0553280E7348C11C790

Function 00BD19E2 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD19E7

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a005c4ab0a6039ba40ea30dfa96f8a5542a69a476f2df1b85b89d3cf464148de
Instruction ID: 4f4728a568ea30367c15deebf0c3c31d951453fc4c186fa533ca75c457af5b18
Opcode Fuzzy Hash: a005c4ab0a6039ba40ea30dfa96f8a5542a69a476f2df1b85b89d3cf464148de
Instruction Fuzzy Hash: 17B1AF70B04646BEEB28CF7CC484AB9FBE6EF05304F18499BE46597381E7319964CB91

Function 00BD81ED Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD81F2

Part of subcall function 00BD13AF: __EH_prolog.LIBCMT ref: 00BD13B4
Part of subcall function 00BD13AF: new.LIBCMT ref: 00BD142C

Part of subcall function 00BD19E2: __EH_prolog.LIBCMT ref: 00BD19E7

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1a94b79079f62e48afa1e59755dfb3a219c3ac0ddfda7c228f87c7cec7675faa
Instruction ID: ecd30a867f13caaaee39d4b0e3c848c7e9d1cdd555ac7ebb2ca7678b5e81e8a5
Opcode Fuzzy Hash: 1a94b79079f62e48afa1e59755dfb3a219c3ac0ddfda7c228f87c7cec7675faa
Instruction Fuzzy Hash: 4041A1719406589ADB24EB64C851BFAF7E9AF50710F0404EBF44AA3282EB745EC8DB54

Function 00BE21E5 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BE21EA

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d924bde57b18e6ec8008ffe9c6fe0f141461cc51bd1d246af766073cfd5f0cc4
Instruction ID: f31174d2886269b134b74e272bd3f5984899a0b7196b99fd29e89313bec82105
Opcode Fuzzy Hash: d924bde57b18e6ec8008ffe9c6fe0f141461cc51bd1d246af766073cfd5f0cc4
Instruction Fuzzy Hash: FC21B9B1E402555BDB149FBA8C41A6A77ECEF08314F0446BAE605EB681D7749D40C6A4

Function 00BE9484 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BE9489

Part of subcall function 00BD13AF: __EH_prolog.LIBCMT ref: 00BD13B4
Part of subcall function 00BD13AF: new.LIBCMT ref: 00BD142C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: be2f1b444d6a98279e1a8a5b54450d9f379c8ee85c75f8206c66c0c124a577b9
Instruction ID: 645475c566c7f556c708c01b0435f6608a195b80ee88d5eefa8f891d1d28aec5
Opcode Fuzzy Hash: be2f1b444d6a98279e1a8a5b54450d9f379c8ee85c75f8206c66c0c124a577b9
Instruction Fuzzy Hash: 9A213071C05289AACF15DF59D9519EDFBF4EF19300F1004EAE409A7202D735AE09DB60

Function 00BD9120 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD9125

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 079896a06899519a28fa9f46874dff6eed664e97b12b98ba9eb9928006646325
Instruction ID: 8f98d33cfa9ca611a0e23293742633324b4657ae10077608fecb2119a628368e
Opcode Fuzzy Hash: 079896a06899519a28fa9f46874dff6eed664e97b12b98ba9eb9928006646325
Instruction Fuzzy Hash: D8117373D0052A6BCB11AE58CC519DEFBB5EF48750F0045A6F805B7311EA358D108794

Function 00BF59EC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF239A,?,0000015D,?,?,?,?,00BF2F19,000000FF,00000000,?,?), ref: 00BF5A1E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0f17107ff1a5d9c6d4d05b753ce6548fd2a1c1b3a1f808b3bfa5997fc75143cf
Instruction ID: 6c261ef5916ab546b014cb6de6bf4aee2376b0137db9c3546817a0bc09e3724d
Opcode Fuzzy Hash: 0f17107ff1a5d9c6d4d05b753ce6548fd2a1c1b3a1f808b3bfa5997fc75143cf
Instruction Fuzzy Hash: 61E0E531120E2C5AE73126659C817BA37C8DF053B1F1603E4AF05938A0FB50CD2885A0

Function 00BD5B05 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD5B0A

Part of subcall function 00BDACB6: __EH_prolog.LIBCMT ref: 00BDACBB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 685511e23f0c608c5d8ba13d9e81809ad9bcd40108bbd1dcaff57a6ee799ead5
Instruction ID: c6abc3ade2ab6e13c54e083ad03c559545943020877c639f5b2d6986afcd2b9a
Opcode Fuzzy Hash: 685511e23f0c608c5d8ba13d9e81809ad9bcd40108bbd1dcaff57a6ee799ead5
Instruction Fuzzy Hash: 1F01623450568ADAC714E7A4C4157EDF7E4DF15300F0080DEA86A73382EBB41B08C7A2

Function 00BDA195 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,?,?), ref: 00BDA1C4

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: ac7d7fdbe3c5e832ecbfcb56a8c2bce1c58b1d36d9ace4b3f757404e520e358a
Instruction ID: b61e5c0f5da180a203c9ced9e11442b1973b006e07bd919dfbe86c4a516edede
Opcode Fuzzy Hash: ac7d7fdbe3c5e832ecbfcb56a8c2bce1c58b1d36d9ace4b3f757404e520e358a
Instruction Fuzzy Hash: 25F0E235408780EFCA225BB48804BCBFBD0AF16331F008A8BF0FD123D2D27514998722

Function 00BD1EBF Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD1EC4

Part of subcall function 00BD1927: __EH_prolog.LIBCMT ref: 00BD192C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ce79a9da99a126c2a488e2458391cc156eda8947ce2f34822351a70d8b670946
Instruction ID: d21adf9b63d5656ae952fc722e8c0b310b2c959421aef60f0d39ae0d16b68c82
Opcode Fuzzy Hash: ce79a9da99a126c2a488e2458391cc156eda8947ce2f34822351a70d8b670946
Instruction Fuzzy Hash: BCF074B1D002899ECF41DFA885466EEBBF4AB19200F0445BAD519A7202E73556058B91

Function 00BD1EC4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD1EC4

Part of subcall function 00BD1927: __EH_prolog.LIBCMT ref: 00BD192C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9174b26c55bc6689883bf4742441a397630375c3705d662e38516824eb19a35e
Instruction ID: 173df2273900744fa8e1b180b008bf73020254f1696674577608b78ca7a5a023
Opcode Fuzzy Hash: 9174b26c55bc6689883bf4742441a397630375c3705d662e38516824eb19a35e
Instruction Fuzzy Hash: FDF092B1C002889ECF41DFA8C946AEEFBF4AB19200F0445BBD409A7202EB3956058B91

Function 00BDF944 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00BDF979

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 79656f8bd1ea9a41e08c03182908f4de0b2a2fadc30ed399438880a5e982f472
Instruction ID: c315382404ad2184c0d9d884c9948b5e78b978e72aa642a5c671a5de2906bfa0
Opcode Fuzzy Hash: 79656f8bd1ea9a41e08c03182908f4de0b2a2fadc30ed399438880a5e982f472
Instruction Fuzzy Hash: 82D0C210B1405126DA15332C384ABBD27D64FC1314F0D00F6B046663C2CB994882E272

Function 00BE8B64 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00BE8B6A

Part of subcall function 00BE8923: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BE8944

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: b3ecc342144db532c8dedf8b776bc33c6e15ccf428a3dce563ad8a90b77a80c7
Instruction ID: c892445b85b3644e39489b090982863ffc6d88e919792911db4072ffda0a774c
Opcode Fuzzy Hash: b3ecc342144db532c8dedf8b776bc33c6e15ccf428a3dce563ad8a90b77a80c7
Instruction Fuzzy Hash: CBD0A77060054C7BDF416B72AC0297E7AD8EB05350F0081B5FC08C5161FF73CD106251

Function 00BD976A Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(000000FF,00BD969C), ref: 00BD9776

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 64007b61f8b01d750cbe1ee53fe7e07ac856f0d2b1cd754a7da902a3bbf9074e
Instruction ID: 46dee49a6e7cb32e48182fe95a40a246b26145ded6e965de57d4d4fdcda66f04
Opcode Fuzzy Hash: 64007b61f8b01d750cbe1ee53fe7e07ac856f0d2b1cd754a7da902a3bbf9074e
Instruction Fuzzy Hash: DCD01230021200558E660E349D49159AA91DB833AAB38CAE9E025C41B1EB22CC43F540

Function 00BEBF76 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 00BEBF9B

Part of subcall function 00BE991D: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BE992E
Part of subcall function 00BE991D: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BE993F
Part of subcall function 00BE991D: TranslateMessage.USER32(?), ref: 00BE9949
Part of subcall function 00BE991D: DispatchMessageW.USER32(?), ref: 00BE9953

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 2c56b7eb15da42702827d142a15fbdee9989f56bc68038e8761551793cdd734a
Instruction ID: a49239ba90978c9649f4ec5f9c6327f89eb26c840c0322d04d96c5c0e38ad60a
Opcode Fuzzy Hash: 2c56b7eb15da42702827d142a15fbdee9989f56bc68038e8761551793cdd734a
Instruction Fuzzy Hash: D4D09E35144300ABDB112B52CE06F0EBAE3BF88B04F404998B244340B1C6629D30EB02

Function 00BDDE2A Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00BDDE34

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ec7ec75973f60482ef44b75c4e6b1ab1d30237552baae88458a9def25a68326f
Instruction ID: 1bdad03fc07166281ae86dee0f1217a05f53e49650867cbf75a6697a245ddadd
Opcode Fuzzy Hash: ec7ec75973f60482ef44b75c4e6b1ab1d30237552baae88458a9def25a68326f
Instruction Fuzzy Hash: 82D0CA70410622CFD7B09F29E804782BBE0FF28312B22886E90CAC2224E6708880CF40

Function 00BECD5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BECD6D

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f2315ae2f309d187e008defb4c44177673ce5301af6c9477b68ec12faaf3faa7
Instruction ID: 19ba2f3b8cc0a904f224ecee3e827e9c7514e0f0e25e556ace229c864787254d
Opcode Fuzzy Hash: f2315ae2f309d187e008defb4c44177673ce5301af6c9477b68ec12faaf3faa7
Instruction Fuzzy Hash: 39B012E1358140BD7114921A6E0AC3B094CC1C0F11330D0BBF401D00C4F9410C47D032

Function 00BEC7BF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC798

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 736467ab0bf88acd29e74b5f02f75d04a6c4356743106f8d0a82a8ddcfd3a0cb
Instruction ID: 1feb0739cf50bc05c6aae1d00e73f7db1b3429965f525ef6410cd25070a234c9
Opcode Fuzzy Hash: 736467ab0bf88acd29e74b5f02f75d04a6c4356743106f8d0a82a8ddcfd3a0cb
Instruction Fuzzy Hash: B3B012E127C1406D7104D1572D06D36058DC1C4F10330C07BF400C11C0DA400C4F4136

Function 00BEC7B5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC798

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cbfcc5aa15c807b8cde72ed8f9b4a96be082ba99f9aa09be7aecb0c55c5f2dc9
Instruction ID: ddd061ea7eb5faee46d543f21599de9845be94d0ea05b1c624dd06b1f1028864
Opcode Fuzzy Hash: cbfcc5aa15c807b8cde72ed8f9b4a96be082ba99f9aa09be7aecb0c55c5f2dc9
Instruction Fuzzy Hash: 53B012E12782446D7104E1472C46C36058CC1C4F10330C07BF400C01C0DA400C07423A

Function 00BEC786 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC798

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0e14af2af59fd5dbf79ee040204ca8bdee650bea02c07c6f08b9f1b1ab9cf30a
Instruction ID: 873096a7c1f56ee18789e18aa188f7de14ccddf5ac91d28adbbdcac7b56bd861
Opcode Fuzzy Hash: 0e14af2af59fd5dbf79ee040204ca8bdee650bea02c07c6f08b9f1b1ab9cf30a
Instruction Fuzzy Hash: 81B012F12783407D7104D1532C46D36094DC1C1F10330C07BF800C00C0DA401C0B403A

Function 00BEC725 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 37774f5d1e7afd319129dd7866ffe1b067f0e50116fe556f77bfaf4223638d95
Instruction ID: cd887a5dda63f5fd42431941b0c3304400edeca4ac48f63b0bb571c159730498
Opcode Fuzzy Hash: 37774f5d1e7afd319129dd7866ffe1b067f0e50116fe556f77bfaf4223638d95
Instruction Fuzzy Hash: 32B012D13587417C7508A1022D86C36054CC1C5F20330C1BBF400C00C4DA400C4BD932

Function 00BEC75E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5fe8a3e3e04279d7f77050d00de0722045a489289b7e140ef63161560c49cb27
Instruction ID: 9283ae173f06a2d3288fc30d33f9b15f5b583e58ac8d638088fca0b43765d4ed
Opcode Fuzzy Hash: 5fe8a3e3e04279d7f77050d00de0722045a489289b7e140ef63161560c49cb27
Instruction Fuzzy Hash: 6FB012D13587416D7108E1063F46C37058CC1C5F10330C0BBF404C01C0DA400C0BD932

Function 00BEC74A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b0f563d11589e12e732e6289d085fbf343e66ec60330a8950b8b4f5f7073a783
Instruction ID: ffeb6a6a283dbee50163844105f5b37abd612a67e95d0c0503f23e24218e6766
Opcode Fuzzy Hash: b0f563d11589e12e732e6289d085fbf343e66ec60330a8950b8b4f5f7073a783
Instruction Fuzzy Hash: 27B012D13686416C7108E5062D46C36058CC1C1F20330C0BBF844C01C0DA400C0BD932

Function 00BEC740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ccf075f4b76d82fcd26f5d9df252c03d05f91403addbb4c762bc63118ef574c
Instruction ID: 96ab843c83b7efc6230434235296522bdaf5d51367f01e024d13a710c65b7b3f
Opcode Fuzzy Hash: 8ccf075f4b76d82fcd26f5d9df252c03d05f91403addbb4c762bc63118ef574c
Instruction Fuzzy Hash: 6AB012D13685416C7108E1066D06C3B058CC1C1F10330C1BBF405C01C0DA400C0BD532

Function 00BEC7B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC798

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6d92a7ead28164858fd668799fb9b1ec75cc6f0ce83d0caf2c077bd6fe018d9f
Instruction ID: 50399ce22ce8c867bcbceb3120cefa083aa1e5e756d7ca4ed948ffa134690bfa
Opcode Fuzzy Hash: 6d92a7ead28164858fd668799fb9b1ec75cc6f0ce83d0caf2c077bd6fe018d9f
Instruction Fuzzy Hash: 4AA001E62B9586BC7108A2936D4AC3A0A9CC5C9F61331D9AAF852C4185AA801C4B5539

Function 00BEC7A6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC798

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6ebc98923209c2ae19a33793737ecbc94dc1c28b5b4ad216de238ac8938fa806
Instruction ID: 50399ce22ce8c867bcbceb3120cefa083aa1e5e756d7ca4ed948ffa134690bfa
Opcode Fuzzy Hash: 6ebc98923209c2ae19a33793737ecbc94dc1c28b5b4ad216de238ac8938fa806
Instruction Fuzzy Hash: 4AA001E62B9586BC7108A2936D4AC3A0A9CC5C9F61331D9AAF852C4185AA801C4B5539

Function 00BEC781 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 77c60281f330ba86a0d571ba1a57ca8d86626b2b645563c519869b4058fb6d18
Instruction ID: 42b36beaf6a1445e52bb022b065a143f62cb1939d80c949b84264256116adb23
Opcode Fuzzy Hash: 77c60281f330ba86a0d571ba1a57ca8d86626b2b645563c519869b4058fb6d18
Instruction Fuzzy Hash: 47A001E62A9996BC7108A6526D4AC3A0A9CC5C6FA1730D9AAF846C4185EA801C4B9531

Function 00BEC777 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d9ea012a5a300171b8e1dcc12a7e4443eebfcbb0c969760e64da1e1b4bfb5d42
Instruction ID: 42b36beaf6a1445e52bb022b065a143f62cb1939d80c949b84264256116adb23
Opcode Fuzzy Hash: d9ea012a5a300171b8e1dcc12a7e4443eebfcbb0c969760e64da1e1b4bfb5d42
Instruction Fuzzy Hash: 47A001E62A9996BC7108A6526D4AC3A0A9CC5C6FA1730D9AAF846C4185EA801C4B9531

Function 00BEC76D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c4e23760464bdfc8ddda6622ee86b8e6ce6292aad38894e260519c483ae1f92e
Instruction ID: 42b36beaf6a1445e52bb022b065a143f62cb1939d80c949b84264256116adb23
Opcode Fuzzy Hash: c4e23760464bdfc8ddda6622ee86b8e6ce6292aad38894e260519c483ae1f92e
Instruction Fuzzy Hash: 47A001E62A9996BC7108A6526D4AC3A0A9CC5C6FA1730D9AAF846C4185EA801C4B9531

Function 00BEC759 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEC737

Part of subcall function 00BECABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BECB38
Part of subcall function 00BECABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BECB49

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7da354aa94536cc8348c2144a6eeba225643bbc32a0dbadba78d4e267b8fab5c
Instruction ID: 42b36beaf6a1445e52bb022b065a143f62cb1939d80c949b84264256116adb23
Opcode Fuzzy Hash: 7da354aa94536cc8348c2144a6eeba225643bbc32a0dbadba78d4e267b8fab5c
Instruction Fuzzy Hash: 47A001E62A9996BC7108A6526D4AC3A0A9CC5C6FA1730D9AAF846C4185EA801C4B9531

Function 00BD94F3 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,?,?,00BD94C3), ref: 00BD950E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 89e6db8fffba4654f5e2add5daf76fd6e8aed950655ea8cd3a13bf241e14374b
Instruction ID: 8c9b26b604dccea6b64e5fd41db3ae1950acf4fd43cc581346198c3c818b648e
Opcode Fuzzy Hash: 89e6db8fffba4654f5e2add5daf76fd6e8aed950655ea8cd3a13bf241e14374b
Instruction Fuzzy Hash: 85F05EB0582B448FDB319A24E559792F7E49B21729F048BAF94E643AE0A361A849CF10

Non-executed Functions

Function 00BEA536 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD12E7: GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
Part of subcall function 00BD12E7: SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00BEA5C7
EndDialog.USER32(?,00000006), ref: 00BEA5DA
GetDlgItem.USER32(?,0000006C), ref: 00BEA5F6
SetFocus.USER32(00000000), ref: 00BEA5FD
SetDlgItemTextW.USER32(?,00000065,?), ref: 00BEA63D
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00BEA670
FindFirstFileW.KERNEL32(?,?), ref: 00BEA686
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BEA6A4
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BEA6B4
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BEA6D1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BEA6EF

Part of subcall function 00BDD192: LoadStringW.USER32(?,?,00000200,?), ref: 00BDD1D7
Part of subcall function 00BDD192: LoadStringW.USER32(?,?,00000200,?), ref: 00BDD1ED

_swprintf.LIBCMT ref: 00BEA71F

Part of subcall function 00BD3F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD3F3E

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00BEA732
FindClose.KERNEL32(00000000), ref: 00BEA735
_swprintf.LIBCMT ref: 00BEA790
SetDlgItemTextW.USER32(?,00000068,?), ref: 00BEA7A3
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00BEA7B9
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00BEA7D9
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BEA7E9
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BEA803
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BEA81B
_swprintf.LIBCMT ref: 00BEA84C
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00BEA85F
_swprintf.LIBCMT ref: 00BEA8AF
SetDlgItemTextW.USER32(?,00000069,?), ref: 00BEA8C2

Part of subcall function 00BE932E: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BE9354
Part of subcall function 00BE932E: GetNumberFormatW.KERNEL32(00000400,00000000,?,00C0A154,?,?), ref: 00BE93A3

Strings

REPLACEFILEDLG, xrefs: 00BEA55D
%s %s, xrefs: 00BEA77E, 00BEA8A1
%s %s %s, xrefs: 00BEA70D, 00BEA839

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3227067027-1840816070
Opcode ID: e3b8d39898868f7bc27ebf24c32b334688fcfc775709b48da24d37d2b53edb3e
Instruction ID: 65a1e8ba2a4bb82e6c7ddb888beedea77d64d8de4d47ae3a4020e50a2c4f8192
Opcode Fuzzy Hash: e3b8d39898868f7bc27ebf24c32b334688fcfc775709b48da24d37d2b53edb3e
Instruction Fuzzy Hash: 17918172548348BBE2219BA1CC89FFFB7ECEB49700F054859B645D21C1E775AA05CB63

Function 00BD7070 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD7075
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 00BD71D5
CloseHandle.KERNEL32(00000000), ref: 00BD71E5

Part of subcall function 00BD7A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BD7AAC
Part of subcall function 00BD7A9D: GetLastError.KERNEL32 ref: 00BD7AF2
Part of subcall function 00BD7A9D: CloseHandle.KERNEL32(?), ref: 00BD7B01

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 00BD71F0
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00BD72FE
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00BD732A
CloseHandle.KERNEL32(?), ref: 00BD733C
GetLastError.KERNEL32(00000015,00000000,?), ref: 00BD734C
RemoveDirectoryW.KERNEL32(?), ref: 00BD7398
DeleteFileW.KERNEL32(?), ref: 00BD73C0

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 00BD70A0
SeRestorePrivilege, xrefs: 00BD7096
UNC\, xrefs: 00BD7120
\??\, xrefs: 00BD70FB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 1551f64d387497bd0a663bcd6728eae89694b43a5f6ffb4ba5511bf1512d2bdc
Instruction ID: 234a52ea1dc80aff5847dfbb62f9ed635cb642ef452ada0c75497738cf41c0d6
Opcode Fuzzy Hash: 1551f64d387497bd0a663bcd6728eae89694b43a5f6ffb4ba5511bf1512d2bdc
Instruction Fuzzy Hash: 6CB1C171944218ABDB20DF64CC85BEEB7F8EF04704F1445AAF919E7242FB34AA45CB64

Function 00BF957E Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BF95C2

Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF917A
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF918C
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF919E
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF91B0
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF91C2
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF91D4
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF91E6
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF91F8
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF920A
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF921C
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF922E
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF9240
Part of subcall function 00BF915D: _free.LIBCMT ref: 00BF9252

_free.LIBCMT ref: 00BF95B7

Part of subcall function 00BF59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?), ref: 00BF59C8
Part of subcall function 00BF59B2: GetLastError.KERNEL32(?,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?,?), ref: 00BF59DA

_free.LIBCMT ref: 00BF95D9
_free.LIBCMT ref: 00BF95EE
_free.LIBCMT ref: 00BF95F9
_free.LIBCMT ref: 00BF961B
_free.LIBCMT ref: 00BF962E
_free.LIBCMT ref: 00BF963C
_free.LIBCMT ref: 00BF9647
_free.LIBCMT ref: 00BF967F
_free.LIBCMT ref: 00BF9686
_free.LIBCMT ref: 00BF96A3
_free.LIBCMT ref: 00BF96BB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1f6a156f3f8ef5fcde367bb81289a45ddf22febb8818c5bb22caf2cf7dab34f7
Instruction ID: d6491da451eeeb85f1b3a65489a52c1b79566380066a017e578fe760f5ff55c9
Opcode Fuzzy Hash: 1f6a156f3f8ef5fcde367bb81289a45ddf22febb8818c5bb22caf2cf7dab34f7
Instruction Fuzzy Hash: C9311B71601708EFEB35AA79D845B76B3E9EF00320F108499E699D7291DB71AD88CB50

Function 00BEB8BB Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00BEB8DC
GetClassNameW.USER32(00000000,?,00000800), ref: 00BEB90B

Part of subcall function 00BE0B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BDAC99,?,?,?,00BDAC48,?,-00000002,?,00000000,?), ref: 00BE0B16

GetWindowLongW.USER32(00000000,000000F0), ref: 00BEB929
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00BEB940
GetObjectW.GDI32(00000000,00000018,?), ref: 00BEB953

Part of subcall function 00BE8B21: GetDC.USER32(00000000), ref: 00BE8B2D
Part of subcall function 00BE8B21: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BE8B3C
Part of subcall function 00BE8B21: ReleaseDC.USER32(00000000,00000000), ref: 00BE8B4A

Part of subcall function 00BE8ADE: GetDC.USER32(00000000), ref: 00BE8AEA
Part of subcall function 00BE8ADE: GetDeviceCaps.GDI32(00000000,00000058), ref: 00BE8AF9
Part of subcall function 00BE8ADE: ReleaseDC.USER32(00000000,00000000), ref: 00BE8B07

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00BEB97A
DeleteObject.GDI32(00000000), ref: 00BEB981
GetWindow.USER32(00000000,00000002), ref: 00BEB98A

Strings

STATIC, xrefs: 00BEB911

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: e8bf651c86c7779f13d6d3856c576c5bc003879ce54f80906e6cfab72a8ad282
Instruction ID: 519baff6d612f0da0fcf91ca76d1cbf544b6a5b192e101d9bbc25152d0b76285
Opcode Fuzzy Hash: e8bf651c86c7779f13d6d3856c576c5bc003879ce54f80906e6cfab72a8ad282
Instruction Fuzzy Hash: 4E2105726007A47BEB206B66CC4AFEF76ADEF04710F0140A1FB05A60D2CB745D41DAB6

Function 00BF621A Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF622E

Part of subcall function 00BF59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?), ref: 00BF59C8
Part of subcall function 00BF59B2: GetLastError.KERNEL32(?,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?,?), ref: 00BF59DA

_free.LIBCMT ref: 00BF623A
_free.LIBCMT ref: 00BF6245
_free.LIBCMT ref: 00BF6250
_free.LIBCMT ref: 00BF625B
_free.LIBCMT ref: 00BF6266
_free.LIBCMT ref: 00BF6271
_free.LIBCMT ref: 00BF627C
_free.LIBCMT ref: 00BF6287
_free.LIBCMT ref: 00BF6295

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9ab5be2026e3c6628e943f3851ac702eb0f0ba44f511c0cd8402db659eec5433
Instruction ID: 560b46ea8d4c60613abb5367ef81d7b1909b2a529e5031812178c37d012ca4e8
Opcode Fuzzy Hash: 9ab5be2026e3c6628e943f3851ac702eb0f0ba44f511c0cd8402db659eec5433
Instruction Fuzzy Hash: 5311637651150CFFDF15EF94C942CE93BB5FF04360B5180A5BB898B222DA71DB949B80

Function 00BD20D3 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 00BD25EB
xc%u, xrefs: 00BD2648
;%u, xrefs: 00BD2408

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 6133c67067248b7e2e754f532feed3c9e544104123e88df348c3b7d3cf08db9d
Instruction ID: 3dadff09a764c0b81af845087e0f6c0656588e890045ae1eb6ec0ab3d5f25c3e
Opcode Fuzzy Hash: 6133c67067248b7e2e754f532feed3c9e544104123e88df348c3b7d3cf08db9d
Instruction Fuzzy Hash: 26F1F6716043C15ADB25EB248895BAEFBD5AFA1300F0844EFFD859B383FA649C45C762

Function 00BE995E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD12E7: GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
Part of subcall function 00BD12E7: SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

EndDialog.USER32(?,00000001), ref: 00BE99AE
SendMessageW.USER32(?,00000080,00000001,?), ref: 00BE99DB
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00BE99F0
SetWindowTextW.USER32(?,?), ref: 00BE9A01
GetDlgItem.USER32(?,00000065), ref: 00BE9A0A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00BE9A1E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00BE9A30

Strings

LICENSEDLG, xrefs: 00BE9972

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: ab47a3a962ef5f3408173dc9472846f0df1c8085418a987a3264cfc1c57b4b62
Instruction ID: eae1f787966602a7614a09e562bd47bf40e370365d86f0aeadccfee07e46022f
Opcode Fuzzy Hash: ab47a3a962ef5f3408173dc9472846f0df1c8085418a987a3264cfc1c57b4b62
Instruction Fuzzy Hash: 6F21C4322043447FE621AB76ED85F7F7BEDEB4AB84F014058F601A25E1CB629C05E676

Function 00BD927D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD9282
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00BD92A5
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00BD92C4

Part of subcall function 00BE0B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00BDAC99,?,?,?,00BDAC48,?,-00000002,?,00000000,?), ref: 00BE0B16

_swprintf.LIBCMT ref: 00BD9360

Part of subcall function 00BD3F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD3F3E

MoveFileW.KERNEL32(?,?), ref: 00BD93D5
MoveFileW.KERNEL32(?,?), ref: 00BD9411

Strings

rtmp%d, xrefs: 00BD9349

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: f3b924c97287bc74f7d8b9fc828567a5b4a0c937cbbab2587c37802e3bd54af1
Instruction ID: 2002b9c19c8da35931927aca96d849ef51b71ba898151d747713becde87b2250
Opcode Fuzzy Hash: f3b924c97287bc74f7d8b9fc828567a5b4a0c937cbbab2587c37802e3bd54af1
Instruction Fuzzy Hash: B8417D71911159AADF20BBA08D54FEAB7BCAF44341F4040E7B909A3342FA349B46CF60

Function 00BE7EE4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,00BE8704,?), ref: 00BE7FB9
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000003,00000000,00000000), ref: 00BE7FDA
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00BE8001

Strings

</html>, xrefs: 00BE7F8B
utf-8"></head>, xrefs: 00BE7F3E
<html>, xrefs: 00BE7F28, 00BE7F61
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00BE7F33

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: 4319112bfd21a13644d9b3ca529ff63f370987661651ce8d0b42c7a58f411f75
Instruction ID: 72561f79ffd7e19a6ca77ba06d8a852d35f1648134fe18910960bd5ed532db85
Opcode Fuzzy Hash: 4319112bfd21a13644d9b3ca529ff63f370987661651ce8d0b42c7a58f411f75
Instruction Fuzzy Hash: 063135320483857AD729AB31DC06FAFB7D8DF52720F144599F610971C2EF709909C7A5

Function 00BE7D95 Relevance: 12.1, APIs: 8, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00BE7DAE
GetTickCount.KERNEL32 ref: 00BE7DCC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BE7DE2
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BE7DF6
TranslateMessage.USER32(?), ref: 00BE7E01
DispatchMessageW.USER32(?), ref: 00BE7E0C
ShowWindow.USER32(?,00000005,?,00000000,?,?,?,?,00000000,00000000,00000000,<html>,00000006), ref: 00BE7EBC
SetWindowTextW.USER32(?,00000000), ref: 00BE7EC6

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Message$CountTickWindow$DispatchPeekShowTextTranslate
String ID:
API String ID: 4150546248-0
Opcode ID: cc04a46f98b67324281d94fff603b69f16973b16b819cb4b3f6a9619571bfe19
Instruction ID: dd190db322ce13ba516fb38f42518f94d596db6bb920681e6be06a605e794a72
Opcode Fuzzy Hash: cc04a46f98b67324281d94fff603b69f16973b16b819cb4b3f6a9619571bfe19
Instruction Fuzzy Hash: 1C412871248346AFD710DF66D888E2BBBEDEF88704B0148ADB646C6250DB71EC45CB62

Function 00BDFE0E Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BDFE21

Part of subcall function 00BDA930: GetVersionExW.KERNEL32(?), ref: 00BDA955

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00BDFE4A
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 00BDFE5C
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00BDFE69
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BDFE7F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BDFE8B
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BDFEC1
__aullrem.LIBCMT ref: 00BDFF4B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 2f73bde6ec4e41dfcec77992402290a97e7f89f2741ae44312f918664f0bbdc6
Instruction ID: 903e9a52fdac47b365d905ea4c0e66098490cf7b50ac7b09f35fd6fd1d289229
Opcode Fuzzy Hash: 2f73bde6ec4e41dfcec77992402290a97e7f89f2741ae44312f918664f0bbdc6
Instruction Fuzzy Hash: 464115B24083169FC314DF65C880AAFFBF8FB88714F104A2EF59692650E779E548DB52

Function 00BFC56D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00BFCCE2,00000000,00000000,00000000,00000000,00000000,00BF2C3E), ref: 00BFC5AF
__fassign.LIBCMT ref: 00BFC62A
__fassign.LIBCMT ref: 00BFC645
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00BFC66B
WriteFile.KERNEL32(?,00000000,00000000,00BFCCE2,00000000,?,?,?,?,?,?,?,?,?,00BFCCE2,00000000), ref: 00BFC68A
WriteFile.KERNEL32(?,00000000,00000001,00BFCCE2,00000000,?,?,?,?,?,?,?,?,?,00BFCCE2,00000000), ref: 00BFC6C3

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 1b6a7c3a9519ff6782c2ef0e922cb9d897f49118f403d5a468ae0ef22afcd914
Instruction ID: 23700f41c277106314b08f7039b2c06580704d3295719e084e6cd8e815915812
Opcode Fuzzy Hash: 1b6a7c3a9519ff6782c2ef0e922cb9d897f49118f403d5a468ae0ef22afcd914
Instruction Fuzzy Hash: 7151C1B090420DAFCB14CFA8D985BEEBBF4FF18300F15419AEA51E7251E730A985CB65

Function 00BEB0D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00BEB0EE
_swprintf.LIBCMT ref: 00BEB122

Part of subcall function 00BD3F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD3F3E

SetDlgItemTextW.USER32(?,00000066,00C13122), ref: 00BEB142
_wcschr.LIBVCRUNTIME ref: 00BEB175
EndDialog.USER32(?,00000001), ref: 00BEB256

Strings

%s%s%u, xrefs: 00BEB117

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 5df237474b69ab203d2e99a94256f680384fb552bb2962d01188deae1f3ec01a
Instruction ID: 1872f86960743cfb9ef5dbec06e3d3daff5d5a91b4911de194578bb19870ef2d
Opcode Fuzzy Hash: 5df237474b69ab203d2e99a94256f680384fb552bb2962d01188deae1f3ec01a
Instruction Fuzzy Hash: 48415C71900299AEEF25DB61CD85FEFB7FCEB09304F1040E6E509E6191EB709A848F65

Function 00BDC96F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00BDC9F5
_strlen.LIBCMT ref: 00BDCA25
_swprintf.LIBCMT ref: 00BDCA46
_wcschr.LIBVCRUNTIME ref: 00BDCA6F
_wcsrchr.LIBVCRUNTIME ref: 00BDCABB

Strings

%08x, xrefs: 00BDCA3A

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcsrchr
String ID: %08x
API String ID: 1593746830-3682738293
Opcode ID: 361af390cbcb339a6575928dd309fc17104dc69f0d13d3264b669bc8fe15d0e3
Instruction ID: 871ac2f02c2e26c1eaef2b1393ac6cecfd810a99cc144cfd872401fb6ed0b685
Opcode Fuzzy Hash: 361af390cbcb339a6575928dd309fc17104dc69f0d13d3264b669bc8fe15d0e3
Instruction Fuzzy Hash: A8411572904346AAD735E620CC89FBBBBDDEB84310F1105ABF94497386EA759D04C2A1

Function 00BE859B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00BE85B4
GetWindowRect.USER32(?,?), ref: 00BE85D9
ShowWindow.USER32(?,00000005,?), ref: 00BE8670
SetWindowTextW.USER32(?,00000000), ref: 00BE8678
ShowWindow.USER32(00000000,00000005), ref: 00BE868E

Strings

RarHtmlClassName, xrefs: 00BE863A

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 40e547ff2c0bd58357a641af898cf76a32e2c220e9fa361043606a9d5f9e7d53
Instruction ID: 679142268b78e3a97874522ee2c1c3b639c8e4eabd9e783277482defb0ee96d0
Opcode Fuzzy Hash: 40e547ff2c0bd58357a641af898cf76a32e2c220e9fa361043606a9d5f9e7d53
Instruction Fuzzy Hash: 64317C32105354AFC7229F659D49B1FBFE8EB48B11F054499FE49AA192DB30D900CBA2

Function 00BF9300 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BF92C4: _free.LIBCMT ref: 00BF92ED

_free.LIBCMT ref: 00BF934E

Part of subcall function 00BF59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?), ref: 00BF59C8
Part of subcall function 00BF59B2: GetLastError.KERNEL32(?,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?,?), ref: 00BF59DA

_free.LIBCMT ref: 00BF9359
_free.LIBCMT ref: 00BF9364
_free.LIBCMT ref: 00BF93B8
_free.LIBCMT ref: 00BF93C3
_free.LIBCMT ref: 00BF93CE
_free.LIBCMT ref: 00BF93D9

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f1ac33a155eeba0822e17f5f402666ce6a004e9925b6c7aeea596f78182db2dd
Instruction ID: 46ce674f75ba78e95d5faf4e608446dcfaee20f60cbb54c6ebe0fab9f7341030
Opcode Fuzzy Hash: f1ac33a155eeba0822e17f5f402666ce6a004e9925b6c7aeea596f78182db2dd
Instruction Fuzzy Hash: E1113D71542B0CFAEA30BBB0CC47FEB77DC9F40724F408955B7A967092DA65A54C4650

Function 00BF0BB4 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BF0BAB,00BEE602), ref: 00BF0BC2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BF0BD0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BF0BE9
SetLastError.KERNEL32(00000000,?,00BF0BAB,00BEE602), ref: 00BF0C3B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 722e261e7a6bb1d583d1be7d1843b81af6f09ec01317c65ee44b4ffab8bf5fe7
Instruction ID: 4e64f18dfa835a4644ff94eec068b7f8b6598b7c309b36c38d31963a3f9f4087
Opcode Fuzzy Hash: 722e261e7a6bb1d583d1be7d1843b81af6f09ec01317c65ee44b4ffab8bf5fe7
Instruction Fuzzy Hash: BF01B13216971A9EE62436B8AC8573E2AD4EB153B9F3107AAF710431F3EB514819D540

Function 00BEC7FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 00BEC816
ReleaseSRWLockExclusive, xrefs: 00BEC83B
AcquireSRWLockExclusive, xrefs: 00BEC82B

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: e6e2abeb34d05fa89bdfd892a36fe2761c247278a9a75aabf381643489cd2262
Instruction ID: a36361a7bd77ecf0979efb6c8518096bd13e47ef98c9795d8588ba45bd4165ed
Opcode Fuzzy Hash: e6e2abeb34d05fa89bdfd892a36fe2761c247278a9a75aabf381643489cd2262
Instruction Fuzzy Hash: 52017D717412A18B9F301F736DC47BA1FC8DB0235532652BAE851C3180EB20C883E7A0

Function 00BE003E Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE009C

Part of subcall function 00BDA930: GetVersionExW.KERNEL32(?), ref: 00BDA955

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BE00BE
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BE00D8
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00BE00E9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE00F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE0105

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 6ec33618796f38623aacaac7c251862407309c99c9531c7dae8e4f661d526fcb
Instruction ID: c61a98d73e6097730aaa3c690fe2539b2379d923272135048f7452b343789d53
Opcode Fuzzy Hash: 6ec33618796f38623aacaac7c251862407309c99c9531c7dae8e4f661d526fcb
Instruction Fuzzy Hash: 4131F57A1183459BC700EFA5C880AABB7F8FF98704F05491EF999D3210E774D549CB2A

Function 00BE820D Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00BE8231
_memcmp.LIBVCRUNTIME ref: 00BE8248

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 291e901cc9d50128a0e1134112c42979b5016f3f1d5a4544199c2e527805fce2
Instruction ID: a4f014aba2e10f555a1fbe05f7ddf8bdfe0f2132cadee4d2111dad49daeb2cb3
Opcode Fuzzy Hash: 291e901cc9d50128a0e1134112c42979b5016f3f1d5a4544199c2e527805fce2
Instruction Fuzzy Hash: 7521C57160098AAFDB019A12DC82E7BB7ECEF50788F1481B8FD089A151E730ED45D691

Function 00BF630E Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00C0CBE8,00BF2664,00C0CBE8,?,?,00BF2203,?,?,00C0CBE8), ref: 00BF6312
_free.LIBCMT ref: 00BF6345
_free.LIBCMT ref: 00BF636D
SetLastError.KERNEL32(00000000,?,00C0CBE8), ref: 00BF637A
SetLastError.KERNEL32(00000000,?,00C0CBE8), ref: 00BF6386
_abort.LIBCMT ref: 00BF638C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 378883f84cc90115d2b6b78c4bd7dc08be2c3726076017eb08995e5c84eccdbd
Instruction ID: 2d73e87dc9954530e94c6cc9e1c8c6fd2f160a72fdd9de74074c9fbf0a767764
Opcode Fuzzy Hash: 378883f84cc90115d2b6b78c4bd7dc08be2c3726076017eb08995e5c84eccdbd
Instruction Fuzzy Hash: 37F0AF36145A0877C72227796C0AF7E23E9DBD1771F3202A4FF2893192FF7588198169

Function 00BEB81F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00BD12E7: GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
Part of subcall function 00BD12E7: SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

EndDialog.USER32(?,00000001), ref: 00BEB86A
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 00BEB880
SetDlgItemTextW.USER32(?,00000065,?), ref: 00BEB89A
SetDlgItemTextW.USER32(?,00000066), ref: 00BEB8A5

Strings

RENAMEDLG, xrefs: 00BEB837

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 858308e0fd0ce337c0f98ed04b717d4730d0c669ed7507dc6c9a8dd8076946d0
Instruction ID: b10551caf8d5b7a2f53f283f44f1e7c98a27ed33533d1fc47276b47acd97aa8e
Opcode Fuzzy Hash: 858308e0fd0ce337c0f98ed04b717d4730d0c669ed7507dc6c9a8dd8076946d0
Instruction Fuzzy Hash: E5012833A403117AD1655E669E88F3B7BACE786F40F000459F341B26E0C3A69C05EBB2

Function 00BF4A7F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BF4A30,?,?,00BF49D0,?,00C07F60,0000000C,00BF4B27,?,00000002), ref: 00BF4A9F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BF4AB2
FreeLibrary.KERNEL32(00000000,?,?,?,00BF4A30,?,?,00BF49D0,?,00C07F60,0000000C,00BF4B27,?,00000002,00000000), ref: 00BF4AD5

Strings

CorExitProcess, xrefs: 00BF4AAA
mscoree.dll, xrefs: 00BF4A98

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 866c02a67e3931f27d49c73620bcba9c0092c4ae7e2171303ba2939aecb28e4f
Instruction ID: 6f748572f70158a4341859115d4aad403838b9ce998b86cb074eddfd872f1bc2
Opcode Fuzzy Hash: 866c02a67e3931f27d49c73620bcba9c0092c4ae7e2171303ba2939aecb28e4f
Instruction Fuzzy Hash: 87F04930A40219BBCB159F90DC09BAEBFF8EF04715F1641A8F905A31A0DB758E44CB94

Function 00BF52C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF5333
_free.LIBCMT ref: 00BF5353

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0831d0139ed31fa40432d82c46021f9c16f5d809183072dcae209a51c3d50fea
Instruction ID: e5d0851ddd586f61eb4768d8458061cd7cf9774bc9f238fc0a317f9bcd3610dc
Opcode Fuzzy Hash: 0831d0139ed31fa40432d82c46021f9c16f5d809183072dcae209a51c3d50fea
Instruction Fuzzy Hash: 74419232A00608EBCB24DF7CC881A6DB7F5EF88314F1545A9E756EB391DA71AD05CB81

Function 00BF89A0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BF89A9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BF89CC

Part of subcall function 00BF59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF239A,?,0000015D,?,?,?,?,00BF2F19,000000FF,00000000,?,?), ref: 00BF5A1E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BF89F2
_free.LIBCMT ref: 00BF8A05
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BF8A14

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 48c0b174f67ce50262bcdc20ab768051e28a0e3f15ddd84da312c679f2cad2a7
Instruction ID: 7ac9699b7829b2eb5e1c71b1b64295744a3c5bf2866115b73f56debc78f42723
Opcode Fuzzy Hash: 48c0b174f67ce50262bcdc20ab768051e28a0e3f15ddd84da312c679f2cad2a7
Instruction Fuzzy Hash: 9C01A77260265D7F672156BA6C8DE7F6AEDDEC6FA132601AAFB04D3101EE608C05C1B1

Function 00BF6392 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BF5E33,00BF5ACF,?,00BF633C,00000001,00000364,?,00BF2203,?,?,00C0CBE8), ref: 00BF6397
_free.LIBCMT ref: 00BF63CC
_free.LIBCMT ref: 00BF63F3
SetLastError.KERNEL32(00000000,?,00C0CBE8), ref: 00BF6400
SetLastError.KERNEL32(00000000,?,00C0CBE8), ref: 00BF6409

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 645deb1cb95a3c624417305d0168af8cf5057a45f257ead4d24632c2ff6385f5
Instruction ID: f902ead83935ca25fe8b8268bae4c4856e19fee5827b4781089d2b19f1029f01
Opcode Fuzzy Hash: 645deb1cb95a3c624417305d0168af8cf5057a45f257ead4d24632c2ff6385f5
Instruction Fuzzy Hash: F701D1721456187BC71237696C85B3B23E9DBD0375B3242A8FF1493292EEB4C80D8125

Function 00BF925B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF9273

Part of subcall function 00BF59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?), ref: 00BF59C8
Part of subcall function 00BF59B2: GetLastError.KERNEL32(?,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?,?), ref: 00BF59DA

_free.LIBCMT ref: 00BF9285
_free.LIBCMT ref: 00BF9297
_free.LIBCMT ref: 00BF92A9
_free.LIBCMT ref: 00BF92BB

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 784f2c5c6fc70be208908b9557beb7e7ab93ee5f69ad594ac5c81a598571e685
Instruction ID: d9455e1083572d06a62c6538ba434ecd00b09b0280ff16fd8e153dd6e82a5b96
Opcode Fuzzy Hash: 784f2c5c6fc70be208908b9557beb7e7ab93ee5f69ad594ac5c81a598571e685
Instruction Fuzzy Hash: D5F01232506708FBDA34EB58E882E2A77E9EA007207658985F748D7641CB74FD84CA51

Function 00BF5513 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF5531

Part of subcall function 00BF59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?), ref: 00BF59C8
Part of subcall function 00BF59B2: GetLastError.KERNEL32(?,?,00BF92F2,?,00000000,?,00000000,?,00BF9319,?,00000007,?,?,00BF9716,?,?), ref: 00BF59DA

_free.LIBCMT ref: 00BF5543
_free.LIBCMT ref: 00BF5556
_free.LIBCMT ref: 00BF5567
_free.LIBCMT ref: 00BF5578

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fae0b4701e71779c1b644144db9c8e5b4acd3237f0a8d2a8af503c5459edc4b1
Instruction ID: 6026afb620b5d358f5624985ccc5af3ba2179826682d750cb403480aa112de5d
Opcode Fuzzy Hash: fae0b4701e71779c1b644144db9c8e5b4acd3237f0a8d2a8af503c5459edc4b1
Instruction Fuzzy Hash: C2F030B08326149BDB35AF58BD0171D3BF1F7147203458286F61453A71DB794D57DB82

Function 00BF4B7A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe,00000104), ref: 00BF4BBA
_free.LIBCMT ref: 00BF4C85
_free.LIBCMT ref: 00BF4C8F

Strings

C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe, xrefs: 00BF4BB1, 00BF4BB8, 00BF4BE7, 00BF4C1F

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\dfbzdfb.sfx.exe
API String ID: 2506810119-2124623071
Opcode ID: f881b3942156f91171d6ee99781446206a19592cd849e0599d9a0733adb63350
Instruction ID: e8e5d12e51330334a0a3ef69f49eca1f28648288906ea106d3b8cadbf3e96436
Opcode Fuzzy Hash: f881b3942156f91171d6ee99781446206a19592cd849e0599d9a0733adb63350
Instruction Fuzzy Hash: 8D316271A0525CEFDB21DB999981ABFBBFCEB85710F1040E6FA0497211DB708E49DB90

Function 00BD7463 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD7468

Part of subcall function 00BD3A90: __EH_prolog.LIBCMT ref: 00BD3A95

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000), ref: 00BD752E

Part of subcall function 00BD7A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BD7AAC
Part of subcall function 00BD7A9D: GetLastError.KERNEL32 ref: 00BD7AF2
Part of subcall function 00BD7A9D: CloseHandle.KERNEL32(?), ref: 00BD7B01

Strings

SeRestorePrivilege, xrefs: 00BD74C1
SeSecurityPrivilege, xrefs: 00BD74AC

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 6fe1a479a61fc9c7fe982fb4a0572e810fcafa9aa31cae8193c03c833f10a611
Instruction ID: 3ea1d8b379b36dd61f80a329597dcc9d2ed4184ca83a002e35a3e35bf673b58c
Opcode Fuzzy Hash: 6fe1a479a61fc9c7fe982fb4a0572e810fcafa9aa31cae8193c03c833f10a611
Instruction Fuzzy Hash: 6C31B371944248ABDF10EF64EC42BEEBBE8EF54314F0140A6F449A7382FB744A44CB62

Function 00BEA8D3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00001000), ref: 00BEA92B
CharUpperW.USER32(?,?,?,?,?,00001000), ref: 00BEA952

Strings

-, xrefs: 00BEA919

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CharUpper
String ID: -
API String ID: 9403516-2547889144
Opcode ID: 01b66e73a218d0e2fe65d63f102b1bdc796a31816df18d01c43970a62a3078e8
Instruction ID: 092e6801cc6fe1e5ff7c060505a83ea26053e5f2be27f312f735a999dea3cf9c
Opcode Fuzzy Hash: 01b66e73a218d0e2fe65d63f102b1bdc796a31816df18d01c43970a62a3078e8
Instruction Fuzzy Hash: 1C213E7A0043C5A5D321AB6B8808B7BE6ECE795310F1544ABF595C2543E7B8E8C4E363

Function 00BE9122 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00BD12E7: GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
Part of subcall function 00BD12E7: SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

EndDialog.USER32(?,00000001), ref: 00BE91AA
GetDlgItemTextW.USER32(?,00000065,00000000,?), ref: 00BE91BF
SetDlgItemTextW.USER32(?,00000065,?), ref: 00BE91D4

Strings

ASKNEXTVOL, xrefs: 00BE913A

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 5cc6a1155b4de90a45842626999d9cb5fb19c9eb91a0f3b949d52242ce345e83
Instruction ID: 3739f2d4c02cc53e6c4d349f0862da21fad960751458e018efe0817db1a3c331
Opcode Fuzzy Hash: 5cc6a1155b4de90a45842626999d9cb5fb19c9eb91a0f3b949d52242ce345e83
Instruction Fuzzy Hash: F5110B32340282BFD615AFA6DD4DF5A7BE9EF46701F014091F600B75A1C3629C4ADB27

Function 00BE9645 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00BD12E7: GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
Part of subcall function 00BD12E7: SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

EndDialog.USER32(?,00000001), ref: 00BE9693
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 00BE96AB
SetDlgItemTextW.USER32(?,00000066,?), ref: 00BE96D9

Strings

GETPASSWORD1, xrefs: 00BE965E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: c50a4ca4e39cd5dc28b375f270e2f9d069fc84104b1d724ca006f10a1a18ed5f
Instruction ID: 11170902ada124f734cc1dbf8d601e11947e23e14d451117e77ffeeeb4b15f01
Opcode Fuzzy Hash: c50a4ca4e39cd5dc28b375f270e2f9d069fc84104b1d724ca006f10a1a18ed5f
Instruction Fuzzy Hash: 591108326002187BDB21AE759D4AFFB77ACEB09710F010092FA04F71C0C3A59D44DAB5

Function 00BDB150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BDB177

Part of subcall function 00BD3F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD3F3E

_wcschr.LIBVCRUNTIME ref: 00BDB195
_wcschr.LIBVCRUNTIME ref: 00BDB1A5

Strings

%c:\, xrefs: 00BDB16D

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 6894a409383bdfb4daa593734646be6833fb08efc296046a70bac6f84412fd54
Instruction ID: 1e685e555ed20f5b9a5b7a3c132ef7143855fa8f196fed927a62902b78370d9b
Opcode Fuzzy Hash: 6894a409383bdfb4daa593734646be6833fb08efc296046a70bac6f84412fd54
Instruction Fuzzy Hash: 0901D267510311F9DA30AB358C82D6BE7ECEE96760751449BFD48E3682FB30D854C2A1

Function 00BDF982 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,00000000,00C11E74,?,?,00BDFB9D,00000020,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?), ref: 00BDF9BB
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?,?,?,00BE3AFE), ref: 00BDF9C5
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?,?,?,00BE3AFE), ref: 00BDF9D5

Strings

Thread pool initialization failed., xrefs: 00BDF9ED

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 8b00ab5be6bde953049fe2e6f540ef195c9b07c2ddc4ee0a990a88bca53276ad
Instruction ID: 856448d75fb82335699edb680c3791e85e5610be6814954bdb35d4a52c156bc9
Opcode Fuzzy Hash: 8b00ab5be6bde953049fe2e6f540ef195c9b07c2ddc4ee0a990a88bca53276ad
Instruction Fuzzy Hash: 931170B1644705AFD3305F659899BABFBECFB95359F21487FE2DE82240EA716840CB10

Function 00BEBEE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00BEBF2B, 00BEBF5D
RENAMEDLG, xrefs: 00BEBF41

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 6f02a24fbe06368129df4777cebdf1d4d0bb5b78353c5fea07a3ddf2cbadc2a3
Instruction ID: bf3a35a047cbfc61fe5e9d450426f48d1bcc1ef611ea06201221ecb71a31a738
Opcode Fuzzy Hash: 6f02a24fbe06368129df4777cebdf1d4d0bb5b78353c5fea07a3ddf2cbadc2a3
Instruction Fuzzy Hash: 1C01B176619241BFC720DB2AED80F6BBBD8F74A380F0546AAF54192230D3219C15EFA1

Function 00BDCE98 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00BDCEA7
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00BDCEB6

Strings

RTL, xrefs: 00BDCEAF, 00BDCEB4, 00BDCEE8
LTR, xrefs: 00BDCEC6, 00BDCED1, 00BDCEDA

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: 7ca59c9501e4090b7f836545fc6ffb5aab15b44bb4d17e4305890ea492a12b0a
Instruction ID: ba56652242e4e3c87ade407f7d32ddeb7db533a9633d591376d632fb3181c6e8
Opcode Fuzzy Hash: 7ca59c9501e4090b7f836545fc6ffb5aab15b44bb4d17e4305890ea492a12b0a
Instruction Fuzzy Hash: EEF08B7160420467E62056745C0AFA73BECE780B00F20029EB606971C0DFA1950CC7B0

Function 00BF6541 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BF65CC
__alldvrm.LIBCMT ref: 00BF67CD
__alldvrm.LIBCMT ref: 00BF67EF

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: be6c9d0d7c1be526505d416ba69bbcf9729ec644743c8de63497f1cd699fda8f
Instruction ID: 9f1401d021d3d87c4e29ec75ad89921b4964d8d6856c47daa13c181a5c8e0c7d
Opcode Fuzzy Hash: be6c9d0d7c1be526505d416ba69bbcf9729ec644743c8de63497f1cd699fda8f
Instruction Fuzzy Hash: BAA1377290028E9FDB21DF18C8917BEBBE5EF65354F1841EEEE859B241C6388D49C750

Function 00BD9F7A Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00BD7F55,?,?,?), ref: 00BDA020
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00BD7F55,?,?), ref: 00BDA064
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00BD7F55,?,?,?,?,?,?,?,?), ref: 00BDA0E5
CloseHandle.KERNEL32(?,?,00000000,?,00BD7F55,?,?,?,?,?,?,?,?,?,?,?), ref: 00BDA0EC

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 076d031028f1ec2490965767d79b86f89280389d418daac078632626d6ca0d88
Instruction ID: a8f6ff80a8021362dbea3e8cd5ed9c9e7f7b636ae3cfa0bf6491b8f965448c29
Opcode Fuzzy Hash: 076d031028f1ec2490965767d79b86f89280389d418daac078632626d6ca0d88
Instruction Fuzzy Hash: A741A3311483815AD731DF24DC46BAEFBE4AB85700F14095EB5D5D32C1E674AA48D753

Function 00BF93E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F5E85006,00BF2784,00000000,00000000,00BF2FB2,?,00BF2FB2,?,00000001,00BF2784,F5E85006,00000001,00BF2FB2,00BF2FB2), ref: 00BF9431
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BF94BA
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00BF94CC
__freea.LIBCMT ref: 00BF94D5

Part of subcall function 00BF59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF239A,?,0000015D,?,?,?,?,00BF2F19,000000FF,00000000,?,?), ref: 00BF5A1E

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 4ae7b7ce20bfc26d3d786ac642836aea7f674fab347709ce8d6b1e6f9346ff5a
Instruction ID: 4840ffbe15ab8484f5c573bec49e3403dab2fe492c48c75fd9188c6551c1a8b2
Opcode Fuzzy Hash: 4ae7b7ce20bfc26d3d786ac642836aea7f674fab347709ce8d6b1e6f9346ff5a
Instruction Fuzzy Hash: BC31B932A0020AABDF258F64CC81ABE3BA5EB50710F1501A8FD14D7291E735CD99CBA0

Function 00BE9A75 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00BE9A85
GetObjectW.GDI32(00000000,00000018,?), ref: 00BE9AA6
DeleteObject.GDI32(00000000), ref: 00BE9ACE
DeleteObject.GDI32(00000000), ref: 00BE9AED

Part of subcall function 00BE8BCF: FindResourceW.KERNEL32(00000066,PNG,?,?,00BE9AC7,00000066), ref: 00BE8BE0
Part of subcall function 00BE8BCF: SizeofResource.KERNEL32(00000000,75755780,?,?,00BE9AC7,00000066), ref: 00BE8BF8
Part of subcall function 00BE8BCF: LoadResource.KERNEL32(00000000,?,?,00BE9AC7,00000066), ref: 00BE8C0B
Part of subcall function 00BE8BCF: LockResource.KERNEL32(00000000,?,?,00BE9AC7,00000066), ref: 00BE8C16

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: a269ac9b06ac4f097425e487d5f9a8c0ed90176b58b42e660b02b13ef5c91933
Instruction ID: 9b3363cfb7c0ccdb1bf49a57537c504cb607102e125685c4b64afc13e67dc1b2
Opcode Fuzzy Hash: a269ac9b06ac4f097425e487d5f9a8c0ed90176b58b42e660b02b13ef5c91933
Instruction Fuzzy Hash: 050176326406502BC610737A8C42FBF72EEEF84B21F0A00A0FE08A7291DF628C15D2A1

Function 00BF0FD6 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00BF0FED

Part of subcall function 00BF1625: ___AdjustPointer.LIBCMT ref: 00BF166F

_UnwindNestedFrames.LIBCMT ref: 00BF1004
___FrameUnwindToState.LIBVCRUNTIME ref: 00BF1016
CallCatchBlock.LIBVCRUNTIME ref: 00BF103A

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: b9fa4c2ca776b65944230fb083eb0fa8b0de912ee33a1d220a96a688825d65b2
Instruction ID: 16c6575b17b61b861cd0693a21a8efdd71600a6c6254e62dbda5c4366d614980
Opcode Fuzzy Hash: b9fa4c2ca776b65944230fb083eb0fa8b0de912ee33a1d220a96a688825d65b2
Instruction Fuzzy Hash: B001293200014DFBCF226F59CC01EEA3BBAEF58754F044854FA1866121D776E8A5EBA0

Function 00BDFB54 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BDFB59
EnterCriticalSection.KERNEL32(00C11E74,?,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?,?,?,00BE3AFE,?,00008000), ref: 00BDFB66
new.LIBCMT ref: 00BDFB82

Part of subcall function 00BDF982: InitializeCriticalSection.KERNEL32(000001A0,00000000,00C11E74,?,?,00BDFB9D,00000020,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?), ref: 00BDF9BB
Part of subcall function 00BDF982: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?,?,?,00BE3AFE), ref: 00BDF9C5
Part of subcall function 00BDF982: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?,?,?,00BE3AFE), ref: 00BDF9D5

LeaveCriticalSection.KERNEL32(00C11E74,?,00BDA812,?,00BDC79B,?,00000000,?,00000001,?,?,?,00BE3AFE,?,00008000,?), ref: 00BDFBA3

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CriticalSection$Create$EnterEventH_prologInitializeLeaveSemaphore
String ID:
API String ID: 3780591329-0
Opcode ID: 93cd7d95c91cafa0ec2ebe5beb8d4e7ef1b01f766a182b7241333dae31eb5c08
Instruction ID: 9e5740a45658562c5e270c8dc2da28f09181d431508034522ba6a7038982dc59
Opcode Fuzzy Hash: 93cd7d95c91cafa0ec2ebe5beb8d4e7ef1b01f766a182b7241333dae31eb5c08
Instruction Fuzzy Hash: C2F06D35A016169BDB089FA8EC15BFDBBE4FF4A304F0080BAED0AD3350EB7588008B54

Function 00BF0B06 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00BF0B06
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00BF0B0B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00BF0B10

Part of subcall function 00BF1BDE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00BF1BEF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00BF0B25

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 531e6f4e0a03c94a47563f5691ee99a7aac98bf87a5ed1e2fb88b7d1485fc598
Instruction ID: 81f7411b637c5633b010a756595607b22ec616a660f494f2c27abfe83a599447
Opcode Fuzzy Hash: 531e6f4e0a03c94a47563f5691ee99a7aac98bf87a5ed1e2fb88b7d1485fc598
Instruction Fuzzy Hash: C0C04C1466029DD41C243BB921462FD13C09C627CC7D01DC1EF501B5275A46040F6033

Function 00BE8CF2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00BE8BA4: GetDC.USER32(00000000), ref: 00BE8BA8
Part of subcall function 00BE8BA4: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BE8BB3
Part of subcall function 00BE8BA4: ReleaseDC.USER32(00000000,00000000), ref: 00BE8BBE

GetObjectW.GDI32(?,00000018,?), ref: 00BE8D23

Part of subcall function 00BE8EE9: GetDC.USER32(00000000), ref: 00BE8EF2
Part of subcall function 00BE8EE9: GetObjectW.GDI32(?,00000018,?), ref: 00BE8F21
Part of subcall function 00BE8EE9: ReleaseDC.USER32(00000000,?), ref: 00BE8FB5

Strings

(, xrefs: 00BE8DEE

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 9f387e836fde609447b5a31121babf0e305f8ea87e47352c90662aba4d734537
Instruction ID: a8db52381dcc4677cabdf0fcce38314586ac96d45e38cf163cc95a520d17a86e
Opcode Fuzzy Hash: 9f387e836fde609447b5a31121babf0e305f8ea87e47352c90662aba4d734537
Instruction Fuzzy Hash: F76114B1208740AFD214DF65C884E6BBBE9FF89704F1049ADF599CB260CB71E905CB62

Function 00BE01CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BE0393

Strings

%ls, xrefs: 00BE020C, 00BE0222
%s: %s, xrefs: 00BE03A2

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 26446982fc88d10c575526e3a19a84ab446aec982fc7ca379e09cd3088809235
Instruction ID: bcaa16584e3559bdc85b5a70d48d83eeb681b91f437606ae3df723688e96866c
Opcode Fuzzy Hash: 26446982fc88d10c575526e3a19a84ab446aec982fc7ca379e09cd3088809235
Instruction Fuzzy Hash: 5051D6311A8381F6E6213A928DCAF3577E5AB05B00F2085C6F7DA784D1C7E1A8D0B61B

Function 00BF7BD9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF7D45

Part of subcall function 00BF5D1D: IsProcessorFeaturePresent.KERNEL32(00000017,00BF5D0C,0000002C,00C080C8,00BF8D62,00000000,00000000,00BF6391,?,?,00BF5D19,00000000,00000000,00000000,00000000,00000000), ref: 00BF5D1F
Part of subcall function 00BF5D1D: GetCurrentProcess.KERNEL32(C0000417,00C080C8,0000002C,00BF5A4A,00000016,00BF6391), ref: 00BF5D41
Part of subcall function 00BF5D1D: TerminateProcess.KERNEL32(00000000), ref: 00BF5D48

Strings

., xrefs: 00BF7EFC
*?, xrefs: 00BF7C1C

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 7b97f05bead931982e7a23c9cf534e270e960d3348eeadaf4e8a2cba3451af48
Instruction ID: d7f8431dcc335713d753baff4b072d4f2119d8060849243053b706584556559f
Opcode Fuzzy Hash: 7b97f05bead931982e7a23c9cf534e270e960d3348eeadaf4e8a2cba3451af48
Instruction Fuzzy Hash: 8951A175E4420DAFDF14CFA8C881ABDBBF5EF48314F2441E9EA54E7300EA719A058B50

Function 00BD7619 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD761E
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD7799

Part of subcall function 00BDA113: SetFileAttributesW.KERNEL32(?,00000000,00000001,?,00BD9F49,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BDA127
Part of subcall function 00BDA113: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BD9F49,?,?,?,00BD9DE2,?,00000001,00000000,?,?), ref: 00BDA158

Strings

:, xrefs: 00BD768F

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: a68e333079cab8ba8bc395942199f897437d3838d18a570a0f58b238e278a368
Instruction ID: 336b5a2b62c0b4a016e762e211015971becaf27917171365405aea462279274b
Opcode Fuzzy Hash: a68e333079cab8ba8bc395942199f897437d3838d18a570a0f58b238e278a368
Instruction Fuzzy Hash: AB417F71905658AADB24EB60CC55EEEB7FCEF45340F0044EBB605A2282FB749F85CB61

Function 00BDB2C5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00BDB317, 00BDB353, 00BDB3B4, 00BDB407
UNC, xrefs: 00BDB361

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 05dbd341e5e586b479fbca728834b0611e3269b9175edd965d1a8aec2828c749
Instruction ID: 63217aba6cea117884de3c1c9e74ab8afd822d2f112fe735d325c38f9b72c669
Opcode Fuzzy Hash: 05dbd341e5e586b479fbca728834b0611e3269b9175edd965d1a8aec2828c749
Instruction Fuzzy Hash: 4141803240025AEACB21EF61CC41EEEF7E9EF01350F5684A7F854A2342F7B09990DE90

Function 00BE802C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00BE8039

Strings

Shell.Explorer, xrefs: 00BE8065
about:blank, xrefs: 00BE80D1

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 7ae5d8308efd0ee8099b7bd6d9bb73790ec134e4e738b484ff52630437425561
Instruction ID: aeb321ac49030dd23394c6d69f9b931921334ef49d54b776b6f856bc5f928dbf
Opcode Fuzzy Hash: 7ae5d8308efd0ee8099b7bd6d9bb73790ec134e4e738b484ff52630437425561
Instruction Fuzzy Hash: C221A175300B46AFD7049F62C890E2BB7E9FF84710B1486A9F5098B292CF71EC44CBA1

Function 00BD12E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00BDCF27: GetWindowRect.USER32(?,?), ref: 00BDCF5E
Part of subcall function 00BDCF27: GetClientRect.USER32(?,?), ref: 00BDCF6A
Part of subcall function 00BDCF27: GetWindowLongW.USER32(?,000000F0), ref: 00BDD00B
Part of subcall function 00BDCF27: GetWindowRect.USER32(?,?), ref: 00BDD038
Part of subcall function 00BDCF27: GetWindowTextW.USER32(?,?,00000400), ref: 00BDD057

GetDlgItem.USER32(00000000,00003021), ref: 00BD132B
SetWindowTextW.USER32(00000000,00C002E4), ref: 00BD1341

Strings

0, xrefs: 00BD12EA

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLong
String ID: 0
API String ID: 660763476-4108050209
Opcode ID: fea0651c38afcb7a282bc6d29763d872439a2acccc08dc35fb81f4c1c719281c
Instruction ID: 1d1277f51c166d0929bdff383fd0ec1a61e9de185be4d50909c66e25f07ab594
Opcode Fuzzy Hash: fea0651c38afcb7a282bc6d29763d872439a2acccc08dc35fb81f4c1c719281c
Instruction Fuzzy Hash: 80F0AFB1540348BBEF251F648C09BE9BFDAEB04764F084896FD44946E1E774C8A4EB18

Function 00BDFB19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00BDFCF9,?,?,00BDFD6E,?,?,?,?,?,00BDFD58), ref: 00BDFB1F
GetLastError.KERNEL32(?,?,00BDFD6E,?,?,?,?,?,00BDFD58), ref: 00BDFB2B

Part of subcall function 00BD6D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD6DAD

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00BDFB34

Memory Dump Source

Source File: 00000004.00000002.1461449379.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000004.00000002.1461415010.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461499206.0000000000C00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C0E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461567083.0000000000C2A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.1461671956.0000000000C2C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_bd0000_dfbzdfb.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 8f511d2727cce935553634a36bdf226837f387adcf4193f6d52d1bccad734926
Instruction ID: 24a7de8958ab69fb8ad2ad544738fb3a9799f0b62574fca7499977a6ea9e8449
Opcode Fuzzy Hash: 8f511d2727cce935553634a36bdf226837f387adcf4193f6d52d1bccad734926
Instruction Fuzzy Hash: 99D05E7160843177CA012328AC1AFBEBB45AB52775F3607A6F23AA53E1DA200C41C6A1

Analysis Process: dfbzdfb.exePID: 6260, Parent PID: 5428COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1466
Total number of Limit Nodes:	22

Executed Functions

Function 0069C130 Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068F3A5: GetModuleHandleW.KERNEL32 ref: 0068F3BD
Part of subcall function 0068F3A5: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0068F3D5
Part of subcall function 0068F3A5: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0068F3F8

Part of subcall function 00698B8D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00698B95

Part of subcall function 00699035: OleInitialize.OLE32(00000000), ref: 0069904E
Part of subcall function 00699035: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00699085
Part of subcall function 00699035: SHGetMalloc.SHELL32(006C20E8), ref: 0069908F

Part of subcall function 00690710: GetCPInfo.KERNEL32(00000000,?), ref: 00690721
Part of subcall function 00690710: IsDBCSLeadByte.KERNEL32(00000000), ref: 00690735

GetCommandLineW.KERNEL32 ref: 0069C178
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0069C19F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0069C1B0
UnmapViewOfFile.KERNEL32(00000000), ref: 0069C1EA

Part of subcall function 0069BE09: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0069BE1F
Part of subcall function 0069BE09: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0069BE5B

CloseHandle.KERNEL32(00000000), ref: 0069C1F3
GetModuleFileNameW.KERNEL32(00000000,006D7938,00000800), ref: 0069C20E
SetEnvironmentVariableW.KERNEL32(sfxname,006D7938), ref: 0069C220
GetLocalTime.KERNEL32(?), ref: 0069C227
_swprintf.LIBCMT ref: 0069C266
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0069C278
GetModuleHandleW.KERNEL32(00000000), ref: 0069C27B
LoadIconW.USER32(00000000,00000064), ref: 0069C292
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00019B4E,00000000), ref: 0069C2E3
Sleep.KERNEL32(?), ref: 0069C311
DeleteObject.GDI32 ref: 0069C350
DeleteObject.GDI32(?), ref: 0069C35C

Part of subcall function 0069A8D3: CharUpperW.USER32(?,?,?,?,00001000), ref: 0069A92B
Part of subcall function 0069A8D3: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 0069A952

CloseHandle.KERNEL32 ref: 0069C39B

Strings

STARTDLG, xrefs: 0069C2D8
sfxstime, xrefs: 0069C273
sfxname, xrefs: 0069C21B
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0069C257
*al, xrefs: 0069C1E0
8ym, xrefs: 0069C207
winrarsfxmappingfile.tmp, xrefs: 0069C193
*xm, xrefs: 0069C1DB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseDeleteObjectProcUpperView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$*al$*xm$8ym$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 985665271-756990092
Opcode ID: 842404879cecf0d9bc6a99e952b0786c9b1ad0821d26969aac1242ac9fcb9faa
Instruction ID: a1d58e019321991c0ec2eccf79772cc42842ce51062e749771e559e83e14d86d
Opcode Fuzzy Hash: 842404879cecf0d9bc6a99e952b0786c9b1ad0821d26969aac1242ac9fcb9faa
Instruction Fuzzy Hash: 5861F6B1904200AFDB60AFA9EC59E7B3BDFEB49710F04152EF94097692DA748D80C7A5

Function 0068A2C3 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0068A1BE,000000FF,?,?), ref: 0068A2F8
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0068A1BE,000000FF,?,?), ref: 0068A32E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0068A1BE,000000FF,?,?), ref: 0068A336
FindNextFileW.KERNEL32(?,?,?,?,?,?,0068A1BE,000000FF,?,?), ref: 0068A35E
GetLastError.KERNEL32(?,?,?,?,0068A1BE,000000FF,?,?), ref: 0068A36A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2b3a06e34ee0740dda795780617c87ffdf244634445bd1497e564e9f0373f510
Instruction ID: 88119ec3d38c9fbade31d488a520b2b55aa6338c1341cbe02b6f7509f743ce36
Opcode Fuzzy Hash: 2b3a06e34ee0740dda795780617c87ffdf244634445bd1497e564e9f0373f510
Instruction Fuzzy Hash: 0C418172604245AFD720EFA8C880ADBF7E9BF49350F040B2EF9D9D3240D734A9548B92

Function 006A49FA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,006A49D0,?,006B7F60,0000000C,006A4B27,?,00000002,00000000), ref: 006A4A1B
TerminateProcess.KERNEL32(00000000,?,006A49D0,?,006B7F60,0000000C,006A4B27,?,00000002,00000000), ref: 006A4A22
ExitProcess.KERNEL32 ref: 006A4A34

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 14dadace8aa739b5d6a19148734c9f6019d782da87721ba740e5fee3e1eb978e
Instruction ID: 113a2940a71f2c7c231870924d8b98e4aa5c2eba8ce3e46290a198c272a58a9e
Opcode Fuzzy Hash: 14dadace8aa739b5d6a19148734c9f6019d782da87721ba740e5fee3e1eb978e
Instruction Fuzzy Hash: E6E04671044108AFCF51BF64DD08A893F6BEB82342F001158F9088A232CF75DD82DF44

Function 006883EB Relevance: 3.9, APIs: 2, Instructions: 931COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006883F0
_memcmp.LIBVCRUNTIME ref: 00688858

Part of subcall function 006880DA: CharUpperW.USER32(?,?,00000000,?,?,?,?,?,?,?,00000800,?,006886CF,?,-00000930,?), ref: 0068819D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CharH_prologUpper_memcmp
String ID:
API String ID: 4047935103-0
Opcode ID: 6e9770829ed11b05fb6d4c914d693ea427bfe7b9307ae049adae440d277730aa
Instruction ID: faee15ca5b4b4b89bedbc4757f501291e279063a223c3be183bbea766439849f
Opcode Fuzzy Hash: 6e9770829ed11b05fb6d4c914d693ea427bfe7b9307ae049adae440d277730aa
Instruction Fuzzy Hash: 41723B70904185AEDF25FF64C885BF977ABAF15300F4C42BAE9499B283DB319E85C760

Function 00699B4E Relevance: 102.2, APIs: 46, Strings: 12, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00699B53

Part of subcall function 006812E7: GetDlgItem.USER32(00000000,00003021), ref: 0068132B
Part of subcall function 006812E7: SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

Strings

@, xrefs: 00699F0D
STARTDLG, xrefs: 00699B72
!l, xrefs: 00699F45
-el -s2 "-d%s" "-sp%s", xrefs: 00699EE7
"%s"%s, xrefs: 0069A089
*al, xrefs: 00699ED0
*xm, xrefs: 00699FB1
__tmp_rar_sfx_access_check_%u, xrefs: 00699E2D
<, xrefs: 00699F00
winrarsfxmappingfile.tmp, xrefs: 00699F22
LICENSEDLG, xrefs: 0069A3D3
*Al, xrefs: 0069A2B9

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: !l$"%s"%s$*Al$*al$*xm$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-430362536
Opcode ID: cc772221d68a1355d712e30d7ce7f58460e9e64fa74ab8d376439319654c7283
Instruction ID: 527eaac67ff55f32c7381ad651f6d9cb564affaca9779c52d40e8bad6dca53bd
Opcode Fuzzy Hash: cc772221d68a1355d712e30d7ce7f58460e9e64fa74ab8d376439319654c7283
Instruction Fuzzy Hash: 094215B0A40345BFEF21ABA49C5AFFA3BAFAB05700F041119FA41A65D1CB744D85CB76

Function 0068F3A5 Relevance: 77.3, APIs: 22, Strings: 22, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0068F3BD
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0068F3D5
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0068F3F8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0068F6A3
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0068F6BB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0068F6CD
ReadFile.KERNEL32(00000000,?,00007FFE,006B0858,00000000), ref: 0068F6EC
CloseHandle.KERNEL32(00000000), ref: 0068F744
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0068F75A
CompareStringW.KERNEL32(00000400,00001001,006B08A4,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 0068F7B4
GetFileAttributesW.KERNELBASE(?,?,006B0870,00000800,?,00000000,?,00000800), ref: 0068F7DD
GetFileAttributesW.KERNEL32(?,?,0k,00000800), ref: 0068F816

Part of subcall function 0068F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0068F376
Part of subcall function 0068F35B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0068DF18,Crypt32.dll,?,0068DF9C,?,0068DF7E,?,?,?,?), ref: 0068F398

_swprintf.LIBCMT ref: 0068F886
_swprintf.LIBCMT ref: 0068F8D2

Part of subcall function 00683F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00683F3E

AllocConsole.KERNEL32 ref: 0068F8DA
GetCurrentProcessId.KERNEL32 ref: 0068F8E4
AttachConsole.KERNEL32(00000000), ref: 0068F8EB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 0068F911
WriteConsoleW.KERNEL32(00000000), ref: 0068F918
Sleep.KERNEL32(00002710), ref: 0068F923
FreeConsole.KERNEL32 ref: 0068F929
ExitProcess.KERNEL32 ref: 0068F931

Strings

k, xrefs: 0068F470
kernel32, xrefs: 0068F3B3
Dk, xrefs: 0068F480
xk, xrefs: 0068F4E8
k, xrefs: 0068F4B8
@k, xrefs: 0068F61E
,k, xrefs: 0068F4D0
tk, xrefs: 0068F490
$k, xrefs: 0068F613
\k, xrefs: 0068F629
xk, xrefs: 0068F634
\k, xrefs: 0068F488
SetDefaultDllDirectories, xrefs: 0068F3F2
Dk, xrefs: 0068F4D8
dwmapi.dll, xrefs: 0068F460, 0068F849
`k, xrefs: 0068F4E0
0k, xrefs: 0068F7FD
SetDllDirectoryW, xrefs: 0068F3CF
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 0068F8C0
DXGIDebug.dll, xrefs: 0068F435, 0068F7A0
uxtheme.dll, xrefs: 0068F853
k, xrefs: 0068F660

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: k$$k$,k$0k$@k$Dk$Dk$DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$\k$\k$`k$dwmapi.dll$kernel32$tk$uxtheme.dll$xk$xk$k$k
API String ID: 1201351596-4133220441
Opcode ID: 5190d57d4a386c5be1dc025409f97979871faf51a94772f8943e4b0d1bd6517f
Instruction ID: d35326bef2b6f63d3451b4d19a548b689960030059080b8930111588aaab9463
Opcode Fuzzy Hash: 5190d57d4a386c5be1dc025409f97979871faf51a94772f8943e4b0d1bd6517f
Instruction Fuzzy Hash: 40D163F1048384AAF770EF50D849BDFBFEAEF84744F501A2DE18896281C7B09589CB56

Function 0069AA44 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 438
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0069AA49

Part of subcall function 006996EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 006997B3

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,0069A35C,?,00000000), ref: 0069AB7E
GetFileAttributesW.KERNEL32(?), ref: 0069AC38
DeleteFileW.KERNEL32(?), ref: 0069AC46
SetWindowTextW.USER32(?,?), ref: 0069AD8F
_wcsrchr.LIBVCRUNTIME ref: 0069AF19
GetDlgItem.USER32(?,00000066), ref: 0069AF54
SetWindowTextW.USER32(00000000,?), ref: 0069AF64
SendMessageW.USER32(00000000,00000143,00000000,006C412A), ref: 0069AF78
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0069AFA1

Strings

, xrefs: 0069ACF2
*Al, xrefs: 0069AF36
%s.%d.tmp, xrefs: 0069AC5E
Software\Microsoft\Windows\CurrentVersion, xrefs: 0069AE38
ProgramFilesDir, xrefs: 0069AE63

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$*Al$ $ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-1871660262
Opcode ID: 0a2e5062c37437d1a5212f36ad98460e9039cfaed41c2ab597190cf2b2f6b96f
Instruction ID: 12bd951565e54eaaea3b98bc042ee7a5cf05921622b39196ee3d13fd5097bf9a
Opcode Fuzzy Hash: 0a2e5062c37437d1a5212f36ad98460e9039cfaed41c2ab597190cf2b2f6b96f
Instruction Fuzzy Hash: FEE180B2900119AAEF20ABA4DD45DEE73BEAF05350F0041AAF945E7541EF709F84CFA5

Function 0068CF27 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068C8DE: _wcschr.LIBVCRUNTIME ref: 0068C90D

GetWindowRect.USER32(?,?), ref: 0068CF5E
GetClientRect.USER32(?,?), ref: 0068CF6A
GetWindowLongW.USER32(?,000000F0), ref: 0068D00B
GetWindowRect.USER32(?,?), ref: 0068D038
GetWindowTextW.USER32(?,?,00000400), ref: 0068D057
SetWindowTextW.USER32(?,?), ref: 0068D07E
GetSystemMetrics.USER32(00000008), ref: 0068D086
GetWindow.USER32(?,00000005), ref: 0068D091
GetWindowTextW.USER32(00000000,?,00000400), ref: 0068D0BC
SetWindowTextW.USER32(00000000,00000000), ref: 0068D0E9
GetWindowRect.USER32(00000000,?), ref: 0068D0FC
GetWindow.USER32(00000000,00000002), ref: 0068D16E

Strings

d, xrefs: 0068CF8A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID: d
API String ID: 4134264131-2564639436
Opcode ID: 71a520183a7445a6d191661d99ed4825ecc55705b291c580fc999aa80674e2ff
Instruction ID: cdd7a88f0a85d8453ce5fedc061c997adc02959f53f727bd521d617942a27cc7
Opcode Fuzzy Hash: 71a520183a7445a6d191661d99ed4825ecc55705b291c580fc999aa80674e2ff
Instruction Fuzzy Hash: 22617FB1208340AFD714DFA8CD88E6BBBEAFFC9714F04561DF69492290C674E9458B62

Function 0069B70D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,006D8958), ref: 0069B71C
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,00699324), ref: 0069B747
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0069B756
SendMessageW.USER32(00000000,000000C2,00000000,006B02E4), ref: 0069B760
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0069B776
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0069B78C
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0069B7CC
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0069B7D6
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0069B7E5
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0069B808
SendMessageW.USER32(00000000,000000C2,00000000,006B1368), ref: 0069B813

Strings

\, xrefs: 0069B77C

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: MessageSend$ItemShowWindow
String ID: \
API String ID: 1207805008-2967466578
Opcode ID: e646e81852bd5980d01296cbe1780433003695ad1286743a693a175da05ad7eb
Instruction ID: bf0e31415cda6fc72eed8fc1f18cf5922d52823568d95bfab420ea359d510e5f
Opcode Fuzzy Hash: e646e81852bd5980d01296cbe1780433003695ad1286743a693a175da05ad7eb
Instruction Fuzzy Hash: 9D215AB12857057FE310EB249C41FAF7EDDEF82714F000609FA90961D0D7A549088BBB

Function 00698BCF Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 92
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(00000066,PNG,?,?,00699AC7,00000066), ref: 00698BE0
SizeofResource.KERNEL32(00000000,75755780,?,?,00699AC7,00000066), ref: 00698BF8
LoadResource.KERNEL32(00000000,?,?,00699AC7,00000066), ref: 00698C0B
LockResource.KERNEL32(00000000,?,?,00699AC7,00000066), ref: 00698C16
GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,00699AC7,00000066), ref: 00698C34
GlobalLock.KERNEL32(00000000), ref: 00698C41
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00698C61
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00698C9C
GlobalUnlock.KERNEL32(00000000), ref: 00698CB1
GlobalFree.KERNEL32(00000000), ref: 00698CB8

Strings

PNG, xrefs: 00698BD1

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 52a37a75f2870220289cafb7eb90398fe505f97d16705d7988275c2d6a090d73
Instruction ID: eb162c8e39eaffd51d265c0ec6450f26b410597d217de3fd390e2ca2a6b02029
Opcode Fuzzy Hash: 52a37a75f2870220289cafb7eb90398fe505f97d16705d7988275c2d6a090d73
Instruction Fuzzy Hash: AA2193B1502301AFDB259F65DD4996BBFAEEF86760B00562CF845D3660DF31DC40CAA0

Function 0069B9A9 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 0069BAD7
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 0069BB1C
GetExitCodeProcess.KERNEL32(?,?), ref: 0069BB54
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0069BB7A
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 0069BC09

Part of subcall function 00690B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0068AC99,?,?,?,0068AC48,?,-00000002,?,00000000,?), ref: 00690B16

Strings

*Ql, xrefs: 0069BA77
, xrefs: 0069BA29
.inf, xrefs: 0069BA93
.exe, xrefs: 0069BB84

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $*Ql$.exe$.inf
API String ID: 3686203788-2161803830
Opcode ID: 83e6c24a6cd201b908acece0f31b041fe86b4e474b9d89bee83b06197ebbaa2b
Instruction ID: f1998430685de6418cba96e698db22d7fd5ae35da391df93e0eb00e2336c161a
Opcode Fuzzy Hash: 83e6c24a6cd201b908acece0f31b041fe86b4e474b9d89bee83b06197ebbaa2b
Instruction Fuzzy Hash: 9351C1704093809ADF31AF14EA54AFBBBEFEF85704F04281DE4C197A98DBA19984C756

Function 0068CB1C Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0068CB21
_wcschr.LIBVCRUNTIME ref: 0068CB3F
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0068CB03,?), ref: 0068CB5A

Part of subcall function 006906D7: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0068B2AB,00000000,?,?,?,?), ref: 006906F3

Strings

*messages***, xrefs: 0068CC5F
*messages***, xrefs: 0068CC26
R, xrefs: 0068CC71
a, xrefs: 0068CC7B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide_wcschr
String ID: *messages***$*messages***$R$a
API String ID: 803915177-2900423073
Opcode ID: f5f04c94ca2ea888b1ae5b93a653981c63216552935b0ab26e103160c1c268c2
Instruction ID: 7907920f42334ce01cf084dfef052fda20e8556d8975d9fd181343c33d3d9bfc
Opcode Fuzzy Hash: f5f04c94ca2ea888b1ae5b93a653981c63216552935b0ab26e103160c1c268c2
Instruction Fuzzy Hash: 709145B2A002059ADB30FF68CC45BEE7BA6EF45320F10466DE649A7391DA709D85CB64

Function 006A739F Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006A2FB2,006A2FB2,?,?,?,006A75F0,00000001,00000001,F5E85006), ref: 006A73F9
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,006A75F0,00000001,00000001,F5E85006,?,?,?), ref: 006A747F
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006A7579
__freea.LIBCMT ref: 006A7586

Part of subcall function 006A59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,006A239A,?,0000015D,?,?,?,?,006A2F19,000000FF,00000000,?,?), ref: 006A5A1E

__freea.LIBCMT ref: 006A758F
__freea.LIBCMT ref: 006A75B4

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 1f314084dd93c42c2c0e1540553c2f946a5223badf14fb8153af08f0c5be6663
Instruction ID: 94fa743aa64806671f6384aa509bb6e4da592ab2a35cff656d42092290081104
Opcode Fuzzy Hash: 1f314084dd93c42c2c0e1540553c2f946a5223badf14fb8153af08f0c5be6663
Instruction Fuzzy Hash: ED51F172A14216ABEB25AF64CC41EEF7BABEB46710F154629FC04D7240EB34DC40DEA4

Function 00698FC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00698FDE
SHAutoComplete.SHLWAPI(?,00000010), ref: 00699015

Part of subcall function 00690B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0068AC99,?,?,?,0068AC48,?,-00000002,?,00000000,?), ref: 00690B16

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00699005

Strings

EDIT, xrefs: 00698FE9, 00698FF4, 00699001
@UJu, xrefs: 00699015

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: 5fc52a7822ef475e0c284afc5dee0e7d3b4bd7da167bc281c0799f5f7d4e0285
Instruction ID: 10346415f5e49eda12200a93a6fcff1d11ff7b5f474e05007c8630e30271dd30
Opcode Fuzzy Hash: 5fc52a7822ef475e0c284afc5dee0e7d3b4bd7da167bc281c0799f5f7d4e0285
Instruction Fuzzy Hash: A2F02772A0032C3BEB305A689C09FDB77AD9F4AB10F44016DFE00F2684E7609941C6F6

Function 0068FA23 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068FDB7: ResetEvent.KERNEL32(?,01393368,0068FA45,006C1E74,01393368,?,-00000001,006AF605,000000FF,?,0068FC7B,?,?,0068A5F0,?), ref: 0068FDD7
Part of subcall function 0068FDB7: ReleaseSemaphore.KERNEL32(?,?,00000000,?,-00000001,006AF605,000000FF,?,0068FC7B,?,?,0068A5F0,?), ref: 0068FDEB

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 0068FA57
CloseHandle.KERNELBASE(0139336C,0139336C), ref: 0068FA71
DeleteCriticalSection.KERNEL32(01393508), ref: 0068FA8A
CloseHandle.KERNELBASE(?), ref: 0068FA96
CloseHandle.KERNEL32(?), ref: 0068FAA2

Part of subcall function 0068FB19: WaitForSingleObject.KERNEL32(?,000000FF,0068FCF9,?,?,0068FD6E,?,?,?,?,?,0068FD58), ref: 0068FB1F
Part of subcall function 0068FB19: GetLastError.KERNEL32(?,?,0068FD6E,?,?,?,?,?,0068FD58), ref: 0068FB2B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: df7156cfb738a72c4a8f9a87c95ea9a2456d8f3c66171fb48e1852412d2d83bf
Instruction ID: ff9bb388795a7068e0de27ec20006bd85603bad92db19c9ba5e1a15dcc55ae65
Opcode Fuzzy Hash: df7156cfb738a72c4a8f9a87c95ea9a2456d8f3c66171fb48e1852412d2d83bf
Instruction Fuzzy Hash: 41019E72040B44EFD721AB68DD48FC6BBEBFB45710F004629F29A92560CB716840CB61

Function 00699035 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0068F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0068F376
Part of subcall function 0068F35B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0068DF18,Crypt32.dll,?,0068DF9C,?,0068DF7E,?,?,?,?), ref: 0068F398

OleInitialize.OLE32(00000000), ref: 0069904E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00699085
SHGetMalloc.SHELL32(006C20E8), ref: 0069908F

Strings

riched20.dll, xrefs: 0069903D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 0d5f74fc7ad8efc541d73ca9e13a8f578975fecdbc0f9128165a96b3bac7f40e
Instruction ID: 8a35ce5c5ddfb32cccfb48581f46ec06b0fdb45677bdb96509f0b1d9e2912720
Opcode Fuzzy Hash: 0d5f74fc7ad8efc541d73ca9e13a8f578975fecdbc0f9128165a96b3bac7f40e
Instruction Fuzzy Hash: C1F04FB1D00109ABCB50AF99D8499EEFFFDEF84310F00415AE814E2200D7B41645CBE1

Function 0068978D Relevance: 6.1, APIs: 4, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,-00000001,00000000,?,00000000,?,?,0068777A,?,00000005,?,00000011), ref: 0068980D
GetLastError.KERNEL32(?,?,0068777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0068981A
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,0068777A,?,00000005,?), ref: 0068984F
GetLastError.KERNEL32(?,?,0068777A,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00689857

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: d624e10c9bb675c425b656e2161943e7ea2ed2070c7dbb3f412ec83c62f0dbf8
Instruction ID: e6b8d6d607c3d150c490b326d9b197d65b5334beedfced7d16133740c5ee9fff
Opcode Fuzzy Hash: d624e10c9bb675c425b656e2161943e7ea2ed2070c7dbb3f412ec83c62f0dbf8
Instruction Fuzzy Hash: AB3137B19407556FE720AF248C45BE7BBA6FB45324F144B29F990873D1D3759888C7A0

Function 00689663 Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00689673
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 0068968B
GetLastError.KERNEL32 ref: 006896BD
GetLastError.KERNEL32 ref: 006896DC

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: e2a785f796f885c70660342bc19facacb65b875e8c5d5f6ea0bbf010fb855907
Instruction ID: d9698380635b06201489036e85c3f15ff3969af9d0351cf7438f2776e78a3e26
Opcode Fuzzy Hash: e2a785f796f885c70660342bc19facacb65b875e8c5d5f6ea0bbf010fb855907
Instruction Fuzzy Hash: 69115A70500214AFEF207F60DC54ABA7BABEB15325F18872AF92685290E7758DC0CF71

Function 006A77C2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006A2203,00000000,00000000,?,006A7769,006A2203,00000000,00000000,00000000,?,006A7966,00000006,FlsSetValue), ref: 006A77F4
GetLastError.KERNEL32(?,006A7769,006A2203,00000000,00000000,00000000,?,006A7966,00000006,FlsSetValue,006B3768,006B3770,00000000,00000364,?,006A63E0), ref: 006A7800
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006A7769,006A2203,00000000,00000000,00000000,?,006A7966,00000006,FlsSetValue,006B3768,006B3770,00000000), ref: 006A780E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 9bfc783d96204243becd563502b82c394dec5568782f6505c678d61d4656927a
Instruction ID: 0b70193a0f3662d3d57d6e8d2cda56972e88b63298007f65f5fe0d1a74346581
Opcode Fuzzy Hash: 9bfc783d96204243becd563502b82c394dec5568782f6505c678d61d4656927a
Instruction Fuzzy Hash: 2601F7767192229BC7216A6D9C48AAB7B9AAF16BA1B100630F91AD7240D724DD41CAE0

Function 0069991D Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0069992E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0069993F
TranslateMessage.USER32(?), ref: 00699949
DispatchMessageW.USER32(?), ref: 00699953

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: f4a48ab6855073e1a87eb39248335615738b0b8b401286fb73e4ad12b11b4edb
Instruction ID: 4309b0b145704fc50b00a72e3dd911718d10d282b3db9dac5e72b9b4c0edf0fd
Opcode Fuzzy Hash: f4a48ab6855073e1a87eb39248335615738b0b8b401286fb73e4ad12b11b4edb
Instruction Fuzzy Hash: 90E0EDB2C0212EB78F20ABE6AD4CDDBBF6DEE062657004115B919D2000D6689545C7F1

Function 0068FBBD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_0000FD4F,?,00000000,00000000), ref: 0068FBE1
SetThreadPriority.KERNEL32(?,00000000), ref: 0068FC28

Part of subcall function 00686D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00686DAD

Strings

CreateThread failed, xrefs: 0068FBED

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 7eb2d1fed8dedb0e404b5d11ca6687187cd3f3b26ca4dcd63f3b3c973ccd497e
Instruction ID: 2784258a0239dfc9796b4c3b3ef1253bf22193fd9ddfcf1a55921dd787dc8815
Opcode Fuzzy Hash: 7eb2d1fed8dedb0e404b5d11ca6687187cd3f3b26ca4dcd63f3b3c973ccd497e
Instruction Fuzzy Hash: 9101F9B534430A6FE3207F58DC42FB7775BEB45761F20063EFA41D6181CAA1A8818774

Function 00689C18 Relevance: 4.6, APIs: 3, Instructions: 96fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,0068C8A3,00000001,?,?,?,00000000,0069420A,?,?,?,?,?,00693CAF), ref: 00689C33
WriteFile.KERNEL32(?,00000000,?,00693EB7,00000000,?,?,00000000,0069420A,?,?,?,?,?,00693CAF,?), ref: 00689C73
WriteFile.KERNELBASE(?,00000000,?,00693EB7,00000000,?,00000001,?,?,0068C8A3,00000001,?,?,?,00000000,0069420A), ref: 00689CA0

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 4a2c7fdf011c26580752828b475671694cfa5a3cf38627b2bd4dba4971c1d93c
Instruction ID: cd66e1eacac73dc98daa6cc80a6260cd561c1be2148f96724ad77446f44ce0dd
Opcode Fuzzy Hash: 4a2c7fdf011c26580752828b475671694cfa5a3cf38627b2bd4dba4971c1d93c
Instruction Fuzzy Hash: D6310871248609AFDB20BF24D808BB6FBAAFF51310F184719F55593280C776E849CBB5

Function 00689ED6 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 00689EFD
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 00689F30
GetLastError.KERNEL32(?,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 00689F4D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: bad337658cd585c088b3773b84fc7459a3f1209a23b266e25a98adcba701dfe0
Instruction ID: 5075fe2b16adc4bef9db8f486b4c661fff989820622b4da9a57541d941a4b3ed
Opcode Fuzzy Hash: bad337658cd585c088b3773b84fc7459a3f1209a23b266e25a98adcba701dfe0
Instruction Fuzzy Hash: 1A01243110821866EB7ABB684C0AFFE374F9F06741F0C0685FB05E6180D720D980DBB5

Function 00683A90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00683A95

Strings

CMT, xrefs: 00683AA4

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 7425c57780727d53594d0fd484f6e4f4f0c4dcbf1f6b6c72ea746f0d0f7c8f28
Instruction ID: 63f0266cd5af2f2812818f84b7b2bacdfb69b33d209728cbabd65cb17a05a143
Opcode Fuzzy Hash: 7425c57780727d53594d0fd484f6e4f4f0c4dcbf1f6b6c72ea746f0d0f7c8f28
Instruction Fuzzy Hash: 1D61D0B1104F449EDB21EF74CC419EBB7EAAF14701F444A2EE5AB87242DB326A49CF11

Function 006A82B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 006A82D9

Strings

, xrefs: 006A831E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: f92fdce20457295aacf57198dc4634995c834c06602806839dd79a77a4db5f5f
Instruction ID: 0ba7302ad8708fd7cfb3be08d883da68db9001714f8ea9f0613b2388145e9e3b
Opcode Fuzzy Hash: f92fdce20457295aacf57198dc4634995c834c06602806839dd79a77a4db5f5f
Instruction Fuzzy Hash: A9410B7090834C9FDF219E688C84AFABBFBEB56704F1404EDE58A87142E635AD45DF60

Function 00681DD2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00681DD7

Part of subcall function 00683A90: __EH_prolog.LIBCMT ref: 00683A95

Strings

CMT, xrefs: 00681E0D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 92596bcb81a3ba09183f69771f898ffc4abde23dfa6364bd291b8c26a159d16c
Instruction ID: f51bb8aff1ad3a96cbd103d49d18d1116170bf1ec2ac2f57a66dc0ff7d23c6da
Opcode Fuzzy Hash: 92596bcb81a3ba09183f69771f898ffc4abde23dfa6364bd291b8c26a159d16c
Instruction Fuzzy Hash: 642139719001099FCB55EF98C9459EEFBFABF59300F10056EE845AB252C7325E12CF65

Function 0068192C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0068192C

Strings

CMT, xrefs: 006819A5

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: f1c0b514c2b0b3fda0e7caddffde44fe9a8d8d309cf898cd0a52193ba67049c2
Instruction ID: 09a7eeb1326b617163c25391ca826ebf77e85589e21d51fb4286b91e4747f8e9
Opcode Fuzzy Hash: f1c0b514c2b0b3fda0e7caddffde44fe9a8d8d309cf898cd0a52193ba67049c2
Instruction Fuzzy Hash: 2D11B171A00205AFCF14EF65D4A5ABEFBAFBF46300F04421AE8469B341DB359852DB90

Function 006A79FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F5E85006,00000001,?,000000FF), ref: 006A7A6B

Strings

LCMapStringEx, xrefs: 006A7A0B, 006A7A15

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: dbbad2eebbf4726f9c733df4413794e3833ead3e5acf7b98271e5e6cdefa5494
Instruction ID: 7dc534d35cca5e1fd08eba67e782b680d0c77769b821ab55b5ea3982c932c093
Opcode Fuzzy Hash: dbbad2eebbf4726f9c733df4413794e3833ead3e5acf7b98271e5e6cdefa5494
Instruction Fuzzy Hash: 3D0117B6644219BBCF02AF90DC05DEE7F63EB08750F014214FE1865261DA328A71AB84

Function 006A7998 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,006A708B), ref: 006A79E3

Strings

InitializeCriticalSectionEx, xrefs: 006A79B3

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 1475c45fba655f16aa50bbb378e2cd5c9c5aa9e66931df243c84476044b6f3cf
Instruction ID: af92acee52b9bd77dc90b140eb31c93a784a81f97045811e2c226b07352b2239
Opcode Fuzzy Hash: 1475c45fba655f16aa50bbb378e2cd5c9c5aa9e66931df243c84476044b6f3cf
Instruction Fuzzy Hash: C2F024B464021CBBCB006F90DC05C9EBFA3EB05720B004229FC185A260DA718E50DBC4

Function 006A783D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 006A787C

Strings

FlsAlloc, xrefs: 006A7858

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 51138d017fba2aec7610bbca81749f75bc1c1c9c8aa862ea736e8037584a94b7
Instruction ID: 450b80573d892de218865f27a28b3670f64a77b65f2f334bfe9c108cb7dd1f77
Opcode Fuzzy Hash: 51138d017fba2aec7610bbca81749f75bc1c1c9c8aa862ea736e8037584a94b7
Instruction Fuzzy Hash: 81E05CF0B452187783047BA49C05DAE7F97CB05710B410178FD0157340DD705E4087C9

Function 006A1D87 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 006A1D9C

Strings

FlsAlloc, xrefs: 006A1D8B, 006A1D95

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 2f35847d98d9bd9792149c7bdfd7fced55cf31ef56e656ec67db904e2c53a87d
Instruction ID: e5d57262895a468692e759b9080e3e758906ae26fb13b15e12ebad4fda9c2d88
Opcode Fuzzy Hash: 2f35847d98d9bd9792149c7bdfd7fced55cf31ef56e656ec67db904e2c53a87d
Instruction Fuzzy Hash: 0FD02EB6BC23383BD61036D8AC02AEABE0BCB03FB1F450161FF082D28295A1188047D5

Function 006A8609 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 006A81DC: GetOEMCP.KERNEL32(00000000,?,?,006A8465,?), ref: 006A8207

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,006A84AA,?,00000000), ref: 006A867D
GetCPInfo.KERNEL32(00000000,006A84AA,?,?,?,006A84AA,?,00000000), ref: 006A8690

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 30fe56efbb956f38081901637864f85b0063841e0741b550136a666315f705ea
Instruction ID: 5ed6bf69bd6e2ca89afbc444d78640902f6fd3d72692280bd1ee9c6db71e31ff
Opcode Fuzzy Hash: 30fe56efbb956f38081901637864f85b0063841e0741b550136a666315f705ea
Instruction Fuzzy Hash: 5B51E1709002059EEB25AF75C885AFEBBE7EF43310F24446ED0868B251EB75DD428F91

Function 006813B4 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006813B4

Part of subcall function 00685F9E: __EH_prolog.LIBCMT ref: 00685FA3

Part of subcall function 0068C463: __EH_prolog.LIBCMT ref: 0068C468
Part of subcall function 0068C463: new.LIBCMT ref: 0068C4AB
Part of subcall function 0068C463: new.LIBCMT ref: 0068C4CF

new.LIBCMT ref: 0068142C

Part of subcall function 0068ACB6: __EH_prolog.LIBCMT ref: 0068ACBB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 88d2537a28108f0e3677a1d29d7490b72363d7e2c82d70d03a64efc2e17446e2
Instruction ID: c79fdb52cf6a43b02aa87055edd7d35cb2201b0128448da90af72d77e9023cba
Opcode Fuzzy Hash: 88d2537a28108f0e3677a1d29d7490b72363d7e2c82d70d03a64efc2e17446e2
Instruction Fuzzy Hash: 014134B0805B40DEE720DF7984859E6FBEAFF29310F504A6ED5EE87282CB326554CB15

Function 006813AF Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006813B4

Part of subcall function 00685F9E: __EH_prolog.LIBCMT ref: 00685FA3

Part of subcall function 0068C463: __EH_prolog.LIBCMT ref: 0068C468
Part of subcall function 0068C463: new.LIBCMT ref: 0068C4AB
Part of subcall function 0068C463: new.LIBCMT ref: 0068C4CF

new.LIBCMT ref: 0068142C

Part of subcall function 0068ACB6: __EH_prolog.LIBCMT ref: 0068ACBB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4cce0dfc4c0f494c19fe25b0c09b586bb6a8fa5fd52176f003118acdd80898d8
Instruction ID: 8a9af79598d92543e381732a77498c35da0acfba5e5553f72b233d2cf258ebfc
Opcode Fuzzy Hash: 4cce0dfc4c0f494c19fe25b0c09b586bb6a8fa5fd52176f003118acdd80898d8
Instruction Fuzzy Hash: 114124B0805B409EE720DF7984859E6FBEAFF29310F504A6ED5EE87282CB326554CB15

Function 006A8448 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 006A630E: GetLastError.KERNEL32(?,006BCBE8,006A2664,006BCBE8,?,?,006A2203,?,?,006BCBE8), ref: 006A6312
Part of subcall function 006A630E: _free.LIBCMT ref: 006A6345
Part of subcall function 006A630E: SetLastError.KERNEL32(00000000,?,006BCBE8), ref: 006A6386
Part of subcall function 006A630E: _abort.LIBCMT ref: 006A638C

Part of subcall function 006A8567: _abort.LIBCMT ref: 006A8599
Part of subcall function 006A8567: _free.LIBCMT ref: 006A85CD

Part of subcall function 006A81DC: GetOEMCP.KERNEL32(00000000,?,?,006A8465,?), ref: 006A8207

_free.LIBCMT ref: 006A84C0
_free.LIBCMT ref: 006A84F6

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: fb47da8c2d8a3da92f7eecc32bbd4fc4112505489328ef04251fbe216f4b70ae
Instruction ID: 68b2c2357ead88d98e45ab73de939573a8b551734fcd8cca0f289e1ea0dd7dbc
Opcode Fuzzy Hash: fb47da8c2d8a3da92f7eecc32bbd4fc4112505489328ef04251fbe216f4b70ae
Instruction Fuzzy Hash: 7731AF31904205AFDB10FBA8D445AAD77F6EF46320F25419DE9049B3A2EF359E41CF54

Function 00689541 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00689BD7,?,?,00687735), ref: 006895C9
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00689BD7,?,?,00687735), ref: 006895FE

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 390c9b3cf4ce1e3b7b6d34f937a1f08e7c9f7aaf8e55dd4c8b8deb8d45f4f180
Instruction ID: 327e973e001c7281beb53eb7bdd2212cf5f274e3938552a3ac2e10418509a5dc
Opcode Fuzzy Hash: 390c9b3cf4ce1e3b7b6d34f937a1f08e7c9f7aaf8e55dd4c8b8deb8d45f4f180
Instruction Fuzzy Hash: 8C21D2B1404748AEE731AF24CC85BF77BEAEB05764F044A2DF5E592291C374AC898B71

Function 00689A62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00687436,?,?,?), ref: 00689A7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00689B2C

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 1217d95882bca446feb694610656b4419b3ade644c455bd2e550c0ac63f94021
Instruction ID: 5bfc1dea75156773353a201c062e213794a9bac64cfd2e9ee5f852af1d024358
Opcode Fuzzy Hash: 1217d95882bca446feb694610656b4419b3ade644c455bd2e550c0ac63f94021
Instruction Fuzzy Hash: 3321D331258285AFC718EF24C891AFBBBE5AF96704F4C4A1DB8D587241D329ED4CC7A1

Function 006A7726 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 006A7786
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 006A7793

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 9ee6718361a5f7f5254149a7df7462521008ae9159f65cb416fb66143f33440d
Instruction ID: a2c63259cdf738855b8a71c9414afe9163c6fabe91aafc9ac74120e0d5c496e9
Opcode Fuzzy Hash: 9ee6718361a5f7f5254149a7df7462521008ae9159f65cb416fb66143f33440d
Instruction Fuzzy Hash: 3A110A37A041209F9B21FE6CEC9089A7797AB867207164230FC15EF354E731EC418ED1

Function 00689B3B Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00689B71
GetLastError.KERNEL32 ref: 00689B7D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7fd95749bb81b512cae56cc118141de3745a77bb6f01407ea50f684a658b86dd
Instruction ID: 1d0a16be6c0464c75f1cdcdc88ee63a2ea2ccb59f51dfe1260ae2b54084c2fd8
Opcode Fuzzy Hash: 7fd95749bb81b512cae56cc118141de3745a77bb6f01407ea50f684a658b86dd
Instruction Fuzzy Hash: CB0156717052045BD734AE29EC447BBB7DB9B84715F18473EB152C3680DA75DC49C721

Function 006898E7 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 0068993B
GetLastError.KERNEL32 ref: 00689948

Part of subcall function 006896FA: __EH_prolog.LIBCMT ref: 006896FF

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 056d6fccd01e060a39723f0648c467899a89fb2c2b3d71101b4d1149a750e9c8
Instruction ID: d2210af95a8836ddf26049af633e7c71f1997bb840878dd423bdff6b4fba7276
Opcode Fuzzy Hash: 056d6fccd01e060a39723f0648c467899a89fb2c2b3d71101b4d1149a750e9c8
Instruction Fuzzy Hash: 92019E322012069B8F18AE5A9884AFB775BBF5633170D832DF93A8B290D670EC019770

Function 006A5ADA Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006A5AFB

Part of subcall function 006A59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,006A239A,?,0000015D,?,?,?,?,006A2F19,000000FF,00000000,?,?), ref: 006A5A1E

RtlReAllocateHeap.NTDLL(00000000,?,00200000,?,?,006BCBE8,006817D2,?,?,?,?,00000000,?,006813A9,?,?), ref: 006A5B37

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: da4041a293a6589efbc440f8957a1a07b7e038cd699596d425587e582df54e65
Instruction ID: d6b974dba894e9ab748468a350db706504f83a54180be274c1b024ac28bfeb9e
Opcode Fuzzy Hash: da4041a293a6589efbc440f8957a1a07b7e038cd699596d425587e582df54e65
Instruction Fuzzy Hash: 4EF0C231711A15AADB71FA25AC21EAB371FAF83772B11411AF8179A291EE309D018D74

Function 0068FC94 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 0068FCA1
GetProcessAffinityMask.KERNEL32(00000000), ref: 0068FCA8

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 377930eaa95554ea4ad899ab8b54f8201258b683de10d7efd2817017f318cb72
Instruction ID: 59d9f367e37bd465ffb84fc2efc5b23b001c58fcd5d48abc80b14a1e29c06838
Opcode Fuzzy Hash: 377930eaa95554ea4ad899ab8b54f8201258b683de10d7efd2817017f318cb72
Instruction Fuzzy Hash: 7CE06D72A4410E679B08ABA89C059EB779EDA18201720067AAC07D3304F924DE4147A4

Function 0068A113 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00689F49,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 0068A127
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00689F49,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 0068A158

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d26a43d30f9bb8455762b1f1155dd11e4604ad1ee13548fe9f02a11d70a29116
Instruction ID: 5cc788cbd5394c49a259e19173fd37139fed3925e93c7cbb6bbe361f5ae04e57
Opcode Fuzzy Hash: d26a43d30f9bb8455762b1f1155dd11e4604ad1ee13548fe9f02a11d70a29116
Instruction Fuzzy Hash: 59F0653524010D6BEF117FA4DC45BEB7B6EBF04385F448155BE88D6260DB32DE989B50

Function 0069C0CF Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0069C0FD
SetDlgItemTextW.USER32(00000065,?), ref: 0069C114

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: af1b900f73692eda0c7a7d296ef7247b4fbe7b491a482f57fd2bbf00f397ab35
Instruction ID: a7457c3f1ad1073b156cae4be767d866737ad7df659e899ef5ebedb19b8d36f6
Opcode Fuzzy Hash: af1b900f73692eda0c7a7d296ef7247b4fbe7b491a482f57fd2bbf00f397ab35
Instruction Fuzzy Hash: E8F0EC72580348BBEF11B7608C06FEA371F9B04741F44455ABA05935E2D5725E2097B9

Function 00689DFC Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,00689661,?,?,006894BC), ref: 00689E0D
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,00689661,?,?,006894BC), ref: 00689E3B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d5ed812deb400f1674243b670f6989895d9a5ffd75c81009820e021140446b66
Instruction ID: 297bc82e11d35443578cc45d33cfc4ff41ac9acdabaaa15adb24cfb24ee52f1d
Opcode Fuzzy Hash: d5ed812deb400f1674243b670f6989895d9a5ffd75c81009820e021140446b66
Instruction Fuzzy Hash: C0E02B3164010857EB20BF60DC05BEA3B9FAF08781F840165B944C2150DB31DD909A60

Function 00689E63 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00689E58,?,006875A0,?,?,?,?), ref: 00689E74
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00689E58,?,006875A0,?,?,?,?), ref: 00689EA0

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9b5be792d85155429851dca1f3eaa8fe13227033fb70c7052a2dc97335c667ec
Instruction ID: 7bf16c9066f64ed06731da3238f6e2a9edc0ef36e75d604c6871003e51385469
Opcode Fuzzy Hash: 9b5be792d85155429851dca1f3eaa8fe13227033fb70c7052a2dc97335c667ec
Instruction Fuzzy Hash: F2E065365001185BDB50BB68DC05BEA7BAE9F183A2F040361FD48E3290D6719D9487D0

Function 0068F35B Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0068F376
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0068DF18,Crypt32.dll,?,0068DF9C,?,0068DF7E,?,?,?,?), ref: 0068F398

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 73bdf3fca5b7b638183186eedbaf017968f0aafb88be4831d263708793e20895
Instruction ID: 2633aa31907614945d79372505297fe9863fb79ca22665d3dacdbd34babc399c
Opcode Fuzzy Hash: 73bdf3fca5b7b638183186eedbaf017968f0aafb88be4831d263708793e20895
Instruction Fuzzy Hash: 95E0927280011C67DB10ABA49C04FD77B6DEB08381F0401A5B948D2000DA70DA808BF0

Function 00698923 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00698944
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0069894B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 6ad9565e768919b9d62262a54824deba313c7cf2c59bad7ec7f723a1d0b28c1b
Instruction ID: a8f322d9752cd16e58b8177219a4eac28ad790f2220b8aa2fa2b2a999c5dd7cd
Opcode Fuzzy Hash: 6ad9565e768919b9d62262a54824deba313c7cf2c59bad7ec7f723a1d0b28c1b
Instruction Fuzzy Hash: A7E06D71801218EFCB60DF99C501BE9BBEDEF05361F10806EE84593B00E6706E04EB92

Function 0069909D Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,006AF605,000000FF), ref: 006990C6
CoUninitialize.COMBASE(?,?,?,006AF605,000000FF), ref: 006990CB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 1a216fa2cb99ddc8a67e266fa8060eebb47c8a06f327a7fe30d197ee949dba9d
Instruction ID: ef3015bcef2c3e95517b8914f8353612dc11e570206ca21ee5b8f54ea5836fdd
Opcode Fuzzy Hash: 1a216fa2cb99ddc8a67e266fa8060eebb47c8a06f327a7fe30d197ee949dba9d
Instruction Fuzzy Hash: 24E0DF32508640DFC310DF88DC06F41BBEAFB09B20F00836AB81A83B60CB386C00CB85

Function 006A0C46 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 006A1D87: try_get_function.LIBVCRUNTIME ref: 006A1D9C

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006A0C64
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 006A0C6F

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: b3f11564f2d1c3595b333c073a489b84e9665907631f3bf963ea0392f0d22899
Instruction ID: 62eab989aa81037dad3ceaa5b418d213c737dae06541f87f88db9a5768a309ca
Opcode Fuzzy Hash: b3f11564f2d1c3595b333c073a489b84e9665907631f3bf963ea0392f0d22899
Instruction Fuzzy Hash: 3DD022BCA98302197D8432F4A81248A13479D137B4B70134EE0238D6D3EE369C836C2E

Function 006812C2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 006812D7
ShowWindow.USER32(00000000), ref: 006812DE

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 6be6a79c2619ac7053a354e17fe4a5a62860b08f0cb1aa50f42f6dfe31003cb0
Instruction ID: 80dff21cd2a734bc83216fe872491512d7b3f3ff5e77a10b679582a9b04289f1
Opcode Fuzzy Hash: 6be6a79c2619ac7053a354e17fe4a5a62860b08f0cb1aa50f42f6dfe31003cb0
Instruction Fuzzy Hash: 02C012B2058200BFCB010BB0DC09C2EBBAAABA5312F00CA08B4B5C00A0CA38C060DB12

Function 0068FC3C Relevance: 2.5, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006C1E74,?,?,0068A5F0,?,?,?,?,006AF605,000000FF), ref: 0068FC4B
LeaveCriticalSection.KERNEL32(006C1E74,?,?,0068A5F0,?,?,?,?,006AF605,000000FF), ref: 0068FC89

Part of subcall function 0068FA23: ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 0068FA57
Part of subcall function 0068FA23: CloseHandle.KERNELBASE(0139336C,0139336C), ref: 0068FA71
Part of subcall function 0068FA23: DeleteCriticalSection.KERNEL32(01393508), ref: 0068FA8A
Part of subcall function 0068FA23: CloseHandle.KERNELBASE(?), ref: 0068FA96
Part of subcall function 0068FA23: CloseHandle.KERNEL32(?), ref: 0068FAA2

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CloseCriticalHandleSection$DeleteEnterLeaveReleaseSemaphore
String ID:
API String ID: 3265325312-0
Opcode ID: d440a2fd55e60ad8996e7da7a974e7311dfc45c26fcaa57e1740b50a1eb94897
Instruction ID: a45d6cb96adab0bca68da1e18bb6cc4ca12427c30b5a32eee5be374b9ff969df
Opcode Fuzzy Hash: d440a2fd55e60ad8996e7da7a974e7311dfc45c26fcaa57e1740b50a1eb94897
Instruction Fuzzy Hash: 3CF0A73164121097D7117B15E805AFF766BDB4BB65F14423EFC0497691C7718D41C7A4

Function 006819E2 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006819E7

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c5a66262f03eb7e8dbd3562a93cb495f9f1d90d83a1805733511877b6bf18913
Instruction ID: aa0e4677aa2ab160d03e8244ccf11ef3630c0bd54e5e0049c13f1b70c2356e74
Opcode Fuzzy Hash: c5a66262f03eb7e8dbd3562a93cb495f9f1d90d83a1805733511877b6bf18913
Instruction Fuzzy Hash: C9B1C170A00646AFEB28EF78C444AF9FBABBF06304F14435AE4569B381C7359956CB91

Function 006881ED Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006881F2

Part of subcall function 006813AF: __EH_prolog.LIBCMT ref: 006813B4
Part of subcall function 006813AF: new.LIBCMT ref: 0068142C

Part of subcall function 006819E2: __EH_prolog.LIBCMT ref: 006819E7

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2aa471c01d416f0eae7fd0675cccf6b6aad3d61a238791eca444f3a9f1d516de
Instruction ID: d6028ac7dcbc3441f12b99b4dc4e62dce5737694632f873f5a90868e89224a36
Opcode Fuzzy Hash: 2aa471c01d416f0eae7fd0675cccf6b6aad3d61a238791eca444f3a9f1d516de
Instruction Fuzzy Hash: 7B41CF318406589FDF60FBA0C855BEA736AAF50700F4402EEE58AA3183DB745FC8DB54

Function 006921E5 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 006921EA

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9853fdf3b054999a35b3bc4972f6142be87efed0b191b221a56422af789f6d87
Instruction ID: 0320050432dbe3beb06fdb5be8a6b0e4615d88bfad402089b26f65179a07ab74
Opcode Fuzzy Hash: 9853fdf3b054999a35b3bc4972f6142be87efed0b191b221a56422af789f6d87
Instruction Fuzzy Hash: 5C21B6B1E402166FDF14DFB8CC51AAA766EEF09714F00463EE509EBA81D7749E40C6A8

Function 00699484 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00699489

Part of subcall function 006813AF: __EH_prolog.LIBCMT ref: 006813B4
Part of subcall function 006813AF: new.LIBCMT ref: 0068142C

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f558c4d11108ffb6677e05855f0789a06a478566bdd92f6b510b2f664aedead3
Instruction ID: d1068309a80641fe5e7c5f892ed08684876cf2a4a5ede986e7151a2f3be9f492
Opcode Fuzzy Hash: f558c4d11108ffb6677e05855f0789a06a478566bdd92f6b510b2f664aedead3
Instruction Fuzzy Hash: 1B217F71C042499FCF15EF58D9419EEBBFAAF1A300F0001AEE809B7202D735AE06DB64

Function 00689120 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00689125

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b1f14eef397502ac12884269071cf1f069c9a65fc4df1ad5e75d64bcdaa58cb5
Instruction ID: 52d45995d9e04171cc5640acce35b80072d6baeaf1a672411879a69e642b76b6
Opcode Fuzzy Hash: b1f14eef397502ac12884269071cf1f069c9a65fc4df1ad5e75d64bcdaa58cb5
Instruction Fuzzy Hash: 32117373E045255BCF12BF58CC559EEBB37AF88750F044229F90577211DA308D1087B4

Function 006A8ED5 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 006A5A7D: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006A633C,00000001,00000364,?,006A2203,?,?,006BCBE8), ref: 006A5ABE

_free.LIBCMT ref: 006A8F41

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: e032975ebbae66d82fc58406085c7988e182e8e093097f4fa6ffad3816001ba0
Instruction ID: b9fc6bf9249da50a3e979ed408e74273aee0481f09829dc24b05032446f6b674
Opcode Fuzzy Hash: e032975ebbae66d82fc58406085c7988e182e8e093097f4fa6ffad3816001ba0
Instruction Fuzzy Hash: B3012B722003455FE321DE599C8195AFBEAEBC6370F25051DE59493280EA30AC058B34

Function 006A5A7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006A633C,00000001,00000364,?,006A2203,?,?,006BCBE8), ref: 006A5ABE

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 39881253c2cb7582c8582d2d976e360cf13733d5ebd09955f74081fba394544f
Instruction ID: 788809e209b579fc87f3bf5091a8a0e967ef0f3d8fe273512f8fb44c8cc322c9
Opcode Fuzzy Hash: 39881253c2cb7582c8582d2d976e360cf13733d5ebd09955f74081fba394544f
Instruction Fuzzy Hash: A1F0B431705E346BEB61FA619C85BAA374BAF43760B194215AE1B96294DB60EC008EE4

Function 006A59EC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,006A239A,?,0000015D,?,?,?,?,006A2F19,000000FF,00000000,?,?), ref: 006A5A1E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c7823a9c0cb01c959f30cee0c781467a9c2ea7952a0343e033effa711bf01c6b
Instruction ID: d23dc0d8a25f8e4aed61a062c14788f4467f949ec899ccda7dc2bff80703bb0c
Opcode Fuzzy Hash: c7823a9c0cb01c959f30cee0c781467a9c2ea7952a0343e033effa711bf01c6b
Instruction Fuzzy Hash: 2EE0E531321E215AEB20B6629C417DE374FAB533B0F021369AE07922A0EB60CD008DA4

Function 00685B05 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00685B0A

Part of subcall function 0068ACB6: __EH_prolog.LIBCMT ref: 0068ACBB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 50e86c6773ff229e7e6ad0ada43db260ec0bdf778549b5f40e4d995956237c88
Instruction ID: 5e9f3dca3b3dd5f40e04a9aac5408c5515f1c02be5d31dd19652c2a6a9fc441e
Opcode Fuzzy Hash: 50e86c6773ff229e7e6ad0ada43db260ec0bdf778549b5f40e4d995956237c88
Instruction Fuzzy Hash: FC018634600645DAD704F7A4C4197DDF7E59F15300F40829DA89A63242CFB41B08C7A7

Function 0068A195 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0068A1C4

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: dada54eca70b73e8d65555cba730757be2f570703df1ff37f9da5d04bddeb4bb
Instruction ID: 233898884ae870fce03f4af0a3311d253f7c91adc6000ed94f4bc93116c920d8
Opcode Fuzzy Hash: dada54eca70b73e8d65555cba730757be2f570703df1ff37f9da5d04bddeb4bb
Instruction Fuzzy Hash: 01F0BE31408780EADA627BF48808BCBBFA25F06331F048B0EF5F912292C2B550999732

Function 00681EBF Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00681EC4

Part of subcall function 00681927: __EH_prolog.LIBCMT ref: 0068192C

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 88360b34b44f2639c4c438c91116d307839f6544711e574f303a1a6181d81b36
Instruction ID: 9a2cee963b9568acae81b6d89d9fe8c4084167e8d8ad5b4aa1975887b1558f24
Opcode Fuzzy Hash: 88360b34b44f2639c4c438c91116d307839f6544711e574f303a1a6181d81b36
Instruction Fuzzy Hash: 0CF098B1D002498ECF41EFA8C5456EEBBF5AB1A300F0446BED519E7202E73556158BA5

Function 00681EC4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00681EC4

Part of subcall function 00681927: __EH_prolog.LIBCMT ref: 0068192C

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9174b26c55bc6689883bf4742441a397630375c3705d662e38516824eb19a35e
Instruction ID: 5a867db4f4938f1b0d7479ce8c337ade46f3cc28e8ba94619d5d01da47cfc68d
Opcode Fuzzy Hash: 9174b26c55bc6689883bf4742441a397630375c3705d662e38516824eb19a35e
Instruction Fuzzy Hash: 71F0A5B1C002488ECF81EFA8C546AEEBBF5BB1A300F0446BED409E7202EB355605CB95

Function 0068F944 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0068F979

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 504d0eeb5afb93695badbc65505c348bfe12412a8171a3d467091a735c98820f
Instruction ID: 3e45ec4882633164f2f8aa49894f401eb1766edd15bdb73ce0afc29ea6f362fe
Opcode Fuzzy Hash: 504d0eeb5afb93695badbc65505c348bfe12412a8171a3d467091a735c98820f
Instruction Fuzzy Hash: 7CD02B1170102129EF513B2C680ABFD190B0FC1330F0C027DF44567293CB45088253B2

Function 00698B64 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00698B6A

Part of subcall function 00698923: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00698944

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: b3ecc342144db532c8dedf8b776bc33c6e15ccf428a3dce563ad8a90b77a80c7
Instruction ID: 00ebdb063765b0abe884856581ab2e4b2a9dfa0b354e63e3cebcec511814ee22
Opcode Fuzzy Hash: b3ecc342144db532c8dedf8b776bc33c6e15ccf428a3dce563ad8a90b77a80c7
Instruction Fuzzy Hash: 08D0A7B020010D7FDF81AB648C0297D7A9EEB02360F048139BC04C7650FE71CD11B255

Function 0068976A Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,0068969C), ref: 00689776

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 97824f78c646d776fdb81861b3a14eaad270e0f5fa1620268bf9deaeb2cdf542
Instruction ID: 5706984768f50dadd76733a096e8d8e58944247df73c6a4dc990b2d9c510d470
Opcode Fuzzy Hash: 97824f78c646d776fdb81861b3a14eaad270e0f5fa1620268bf9deaeb2cdf542
Instruction Fuzzy Hash: 27D01270061200658F752E345D090B66A63DB833A672CDBE4E025C41B1C722C843F754

Function 0069BF76 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0069BF9B

Part of subcall function 0069991D: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0069992E
Part of subcall function 0069991D: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0069993F
Part of subcall function 0069991D: TranslateMessage.USER32(?), ref: 00699949
Part of subcall function 0069991D: DispatchMessageW.USER32(?), ref: 00699953

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 5ee76a9bbdb30809c6fa613799e7a5f2fb87a5d5c59747936e93ae67ed98d433
Instruction ID: 001de0147b154757871b8ce244aa317cd70f2375bcac262aa7ae8f8a9b0b0a9d
Opcode Fuzzy Hash: 5ee76a9bbdb30809c6fa613799e7a5f2fb87a5d5c59747936e93ae67ed98d433
Instruction Fuzzy Hash: B0D09E71148200AADB112B51CD06F1A7AA7BB88B04F404658B744340B186629D20EB16

Function 0069CD5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069CD6D

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b6188193ad23aab8fcd29abb57a624def004faeabcfe97baba97f94c727cacfc
Instruction ID: b8a41d5f6d7d789a144f7865fc7bde38f6564789da81ebb0fe725c607e7f315b
Opcode Fuzzy Hash: b6188193ad23aab8fcd29abb57a624def004faeabcfe97baba97f94c727cacfc
Instruction Fuzzy Hash: 57B012E1258004BD751496986F0EC77150FC4C0F31330803FF401D1480F8440CC7C132

Function 0069C74A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 72b4378d8ca08d1233685bf04cf7308fa963e1ee80916ac4b75831324e8ead5c
Instruction ID: b8117ff88e3bfaed2aadc4972b1fcf79a9bd13ea27da533c58bd3f8729e73a5a
Opcode Fuzzy Hash: 72b4378d8ca08d1233685bf04cf7308fa963e1ee80916ac4b75831324e8ead5c
Instruction Fuzzy Hash: DDB012E12685056CB544E58C2D06C76010FC0C0F30330C42FF800C6781D8404D874A32

Function 0069C740 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c1bf9967a42206b16853933764300d090f4960d3b2ac539fab0bacbcbc8175c8
Instruction ID: 3f1ac7f2600aa844a84fd189988395f6201615791e1aff5746658434709b9ea0
Opcode Fuzzy Hash: c1bf9967a42206b16853933764300d090f4960d3b2ac539fab0bacbcbc8175c8
Instruction Fuzzy Hash: 08B012E12684057CB544E1846D06C77010FC0C0F30330852FF401C6681D8404C874636

Function 0069C75E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b395dd04ec0c5f4e881f05c2f5a53f3f1bbd81ff631d405663e62aeb77ff7ce3
Instruction ID: f8337679b7da95b52c251bc08227436beb557788739a4b88e7e46c0d013091f0
Opcode Fuzzy Hash: b395dd04ec0c5f4e881f05c2f5a53f3f1bbd81ff631d405663e62aeb77ff7ce3
Instruction Fuzzy Hash: 5BB012F12586056DB544E58C3F06C77010FC0C0F30330842FF400C6781D8404D874A32

Function 0069C725 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9ec46ff4f5c85ad86121315cd3bfff1df3b0fa340f3df0339e04583aea69567f
Instruction ID: 3b1a3da589c83bce2b116f8321520eff21cc7f82bd15743ac4786d86349d667e
Opcode Fuzzy Hash: 9ec46ff4f5c85ad86121315cd3bfff1df3b0fa340f3df0339e04583aea69567f
Instruction Fuzzy Hash: 04B012E12586057CB904A1882D46C76010FC0C4F30330852FF400C5681D8404DC78A32

Function 0069C7BF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C798

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fe4705da529b7b3f318082579752e5ebc255e4531d29cd4da726dc54f7498892
Instruction ID: 58543df3b0fd576d67dad1315e8f3ec29e05d791b385e97462389fd8c5ebfb76
Opcode Fuzzy Hash: fe4705da529b7b3f318082579752e5ebc255e4531d29cd4da726dc54f7498892
Instruction Fuzzy Hash: 5DB092E12780046C654892956906876010FC084B21320802AB400C66809840088A023A

Function 0069C7B5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C798

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 470618b25bba888228d99542bf1c145c30ac11c3fe6ee5973cb204f3120af351
Instruction ID: daa715f196e6bef0cddc30183dee712fb62e1c8c7f1e219eaae72bfde734f032
Opcode Fuzzy Hash: 470618b25bba888228d99542bf1c145c30ac11c3fe6ee5973cb204f3120af351
Instruction Fuzzy Hash: 5CB012E12781087C7944D2DA2C06C76010FC0C4F31330C02FF400C6780D8400C82033E

Function 0069C786 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C798

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 379b6e726885b09bc5b143873cad0469dacca46477c2606de58ea2273b6c8f1c
Instruction ID: c121f7e82e7ef36228b8372a48b465c46950d10142f54cb7e3cac0b05cd998a9
Opcode Fuzzy Hash: 379b6e726885b09bc5b143873cad0469dacca46477c2606de58ea2273b6c8f1c
Instruction Fuzzy Hash: 6FB012F12781047C7544D2D16C06C76010FC0C1F31330C02FF800C658098401C86033E

Function 0069C76D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d7f3e2b00b2159dddc5f9d5f3186cc1f433cd1ed264a7aff255c62a1321bb555
Instruction ID: 2e4533d196d19d28349928093d7cdf9a072a509e86453332c1d85d980c976145
Opcode Fuzzy Hash: d7f3e2b00b2159dddc5f9d5f3186cc1f433cd1ed264a7aff255c62a1321bb555
Instruction Fuzzy Hash: BEA002D51595167CB544A1516D16C76011EC4C5F71331891EF401C5581995059475575

Function 0069C777 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 997681dbd98fe03928240b4ed59f39b50081e3cc5269a7da7df0a10e9f0447b3
Instruction ID: 2e4533d196d19d28349928093d7cdf9a072a509e86453332c1d85d980c976145
Opcode Fuzzy Hash: 997681dbd98fe03928240b4ed59f39b50081e3cc5269a7da7df0a10e9f0447b3
Instruction Fuzzy Hash: BEA002D51595167CB544A1516D16C76011EC4C5F71331891EF401C5581995059475575

Function 0069C759 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4e1ef23dbda81d30eed10e3a6f5a17111df40f814edf4e306ad08cf57d7f8949
Instruction ID: 2e4533d196d19d28349928093d7cdf9a072a509e86453332c1d85d980c976145
Opcode Fuzzy Hash: 4e1ef23dbda81d30eed10e3a6f5a17111df40f814edf4e306ad08cf57d7f8949
Instruction Fuzzy Hash: BEA002D51595167CB544A1516D16C76011EC4C5F71331891EF401C5581995059475575

Function 0069C7A6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C798

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9d791bfffb7ff693f6ad1c7e422fc82229e556e41653532765111337be612be3
Instruction ID: bb1aa13e6b9f69f469c79005d242cedc0d3ebb4ab754ddae427b6d6ba36f16fb
Opcode Fuzzy Hash: 9d791bfffb7ff693f6ad1c7e422fc82229e556e41653532765111337be612be3
Instruction Fuzzy Hash: 18A002D51795057C754492916D06C76011EC4C5F71371851EF401C5581595019465579

Function 0069C7B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C798

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7f507800e1859a449353d03ee434f0bf8d39f1af8f1a653873b22e483a441d9b
Instruction ID: bb1aa13e6b9f69f469c79005d242cedc0d3ebb4ab754ddae427b6d6ba36f16fb
Opcode Fuzzy Hash: 7f507800e1859a449353d03ee434f0bf8d39f1af8f1a653873b22e483a441d9b
Instruction Fuzzy Hash: 18A002D51795057C754492916D06C76011EC4C5F71371851EF401C5581595019465579

Function 0069C781 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0069C737

Part of subcall function 0069CABB: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0069CB38
Part of subcall function 0069CABB: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0069CB49

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da2744222d2d1df24a115cd9d87527d16fb2d6fdd5898573c1e18aeb1cb6f417
Instruction ID: 2e4533d196d19d28349928093d7cdf9a072a509e86453332c1d85d980c976145
Opcode Fuzzy Hash: da2744222d2d1df24a115cd9d87527d16fb2d6fdd5898573c1e18aeb1cb6f417
Instruction Fuzzy Hash: BEA002D51595167CB544A1516D16C76011EC4C5F71331891EF401C5581995059475575

Function 00699022 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00699279,006C2120,00000000,006C3122,00000006), ref: 00699026

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 445b1bbcb1b0bfe3267e11bd68187318a0126c6adb3d3cd5cc577bcf8c8e5a5a
Instruction ID: fd669f64f6b6f4f8de4fb3006c103e6bb87fdb52adc87145eb0bdc1965f05f98
Opcode Fuzzy Hash: 445b1bbcb1b0bfe3267e11bd68187318a0126c6adb3d3cd5cc577bcf8c8e5a5a
Instruction Fuzzy Hash: DEA0127019410656CB100B34CC09C167A515760702F0097207002C00A0CB308850E500

Function 006894F3 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,006894C3), ref: 0068950E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d7914a7a8e5af6ce4b0fe5f3292bf893dea5a1a839c69de2335706a1816879e0
Instruction ID: 9199b81f32e480f054a1e1639c31733abf76364203e8cb9ad096501b4b6730b4
Opcode Fuzzy Hash: d7914a7a8e5af6ce4b0fe5f3292bf893dea5a1a839c69de2335706a1816879e0
Instruction Fuzzy Hash: 05F0E9B0542B044FDB31AA34D5187E3B7E55B12731F084B1ED0E643AD0D3716449DF21

Non-executed Functions

Function 0069A536 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006812E7: GetDlgItem.USER32(00000000,00003021), ref: 0068132B
Part of subcall function 006812E7: SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0069A5C7
EndDialog.USER32(?,00000006), ref: 0069A5DA
GetDlgItem.USER32(?,0000006C), ref: 0069A5F6
SetFocus.USER32(00000000), ref: 0069A5FD
SetDlgItemTextW.USER32(?,00000065,?), ref: 0069A63D
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0069A670
FindFirstFileW.KERNEL32(?,?), ref: 0069A686
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0069A6A4
FileTimeToSystemTime.KERNEL32(?,?), ref: 0069A6B4
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0069A6D1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0069A6EF

Part of subcall function 0068D192: LoadStringW.USER32(?,?,00000200,?), ref: 0068D1D7
Part of subcall function 0068D192: LoadStringW.USER32(?,?,00000200,?), ref: 0068D1ED

_swprintf.LIBCMT ref: 0069A71F

Part of subcall function 00683F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00683F3E

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0069A732
FindClose.KERNEL32(00000000), ref: 0069A735
_swprintf.LIBCMT ref: 0069A790
SetDlgItemTextW.USER32(?,00000068,?), ref: 0069A7A3
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0069A7B9
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0069A7D9
FileTimeToSystemTime.KERNEL32(?,?), ref: 0069A7E9
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0069A803
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0069A81B
_swprintf.LIBCMT ref: 0069A84C
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0069A85F
_swprintf.LIBCMT ref: 0069A8AF
SetDlgItemTextW.USER32(?,00000069,?), ref: 0069A8C2

Part of subcall function 0069932E: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00699354
Part of subcall function 0069932E: GetNumberFormatW.KERNEL32(00000400,00000000,?,006BA154,?,?), ref: 006993A3

Strings

%s %s %s, xrefs: 0069A70D, 0069A839
REPLACEFILEDLG, xrefs: 0069A55D
%s %s, xrefs: 0069A77E, 0069A8A1

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLoadLocalStringSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3227067027-1840816070
Opcode ID: 74f287a52959dcdb4812306affa2b9b6f36a89834f7e6d06afc4321e4901c13f
Instruction ID: 5ecd11c9f71624d57542a9122931c59bc1c71f4429b0bec0b5aabaf936b93c36
Opcode Fuzzy Hash: 74f287a52959dcdb4812306affa2b9b6f36a89834f7e6d06afc4321e4901c13f
Instruction Fuzzy Hash: ED91E5B2248308BBE721ABE0CD49FFB77EEEB49700F004919F645D6580D630AA4587A3

Function 00687070 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00687075
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 006871D5
CloseHandle.KERNEL32(00000000), ref: 006871E5

Part of subcall function 00687A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00687AAC
Part of subcall function 00687A9D: GetLastError.KERNEL32 ref: 00687AF2
Part of subcall function 00687A9D: CloseHandle.KERNEL32(?), ref: 00687B01

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 006871F0
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 006872FE
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 0068732A
CloseHandle.KERNEL32(?), ref: 0068733C
GetLastError.KERNEL32(00000015,00000000,?), ref: 0068734C
RemoveDirectoryW.KERNEL32(?), ref: 00687398
DeleteFileW.KERNEL32(?), ref: 006873C0

Strings

UNC\, xrefs: 00687120
SeCreateSymbolicLinkPrivilege, xrefs: 006870A0
\??\, xrefs: 006870FB
SeRestorePrivilege, xrefs: 00687096

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: bc55a8095ba66ef83c1112d3f3ec8567f530064e8d313b12d0ea467ac36ed9cd
Instruction ID: af2b66bb91d2585dfddf3b4c5296a1346a06a2bb34ee850cdebf4fd6d665fde1
Opcode Fuzzy Hash: bc55a8095ba66ef83c1112d3f3ec8567f530064e8d313b12d0ea467ac36ed9cd
Instruction Fuzzy Hash: B3B1D1B1904218AFEF20EF64CC45BEE77BAAF09300F144669F959E7242D730EA45CB65

Function 006A957E Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006A95C2

Part of subcall function 006A915D: _free.LIBCMT ref: 006A917A
Part of subcall function 006A915D: _free.LIBCMT ref: 006A918C
Part of subcall function 006A915D: _free.LIBCMT ref: 006A919E
Part of subcall function 006A915D: _free.LIBCMT ref: 006A91B0
Part of subcall function 006A915D: _free.LIBCMT ref: 006A91C2
Part of subcall function 006A915D: _free.LIBCMT ref: 006A91D4
Part of subcall function 006A915D: _free.LIBCMT ref: 006A91E6
Part of subcall function 006A915D: _free.LIBCMT ref: 006A91F8
Part of subcall function 006A915D: _free.LIBCMT ref: 006A920A
Part of subcall function 006A915D: _free.LIBCMT ref: 006A921C
Part of subcall function 006A915D: _free.LIBCMT ref: 006A922E
Part of subcall function 006A915D: _free.LIBCMT ref: 006A9240
Part of subcall function 006A915D: _free.LIBCMT ref: 006A9252

_free.LIBCMT ref: 006A95B7

Part of subcall function 006A59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?), ref: 006A59C8
Part of subcall function 006A59B2: GetLastError.KERNEL32(?,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?,?), ref: 006A59DA

_free.LIBCMT ref: 006A95D9
_free.LIBCMT ref: 006A95EE
_free.LIBCMT ref: 006A95F9
_free.LIBCMT ref: 006A961B
_free.LIBCMT ref: 006A962E
_free.LIBCMT ref: 006A963C
_free.LIBCMT ref: 006A9647
_free.LIBCMT ref: 006A967F
_free.LIBCMT ref: 006A9686
_free.LIBCMT ref: 006A96A3
_free.LIBCMT ref: 006A96BB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: cf484b33e76b38ca2321501b63399ae8002d6cfcc0fa901a4478c310f19a2ba0
Instruction ID: 0028d96d18de470f208fb21709df6763ab2e85a8ce80a38d894e2891a381dd16
Opcode Fuzzy Hash: cf484b33e76b38ca2321501b63399ae8002d6cfcc0fa901a4478c310f19a2ba0
Instruction Fuzzy Hash: 05313771601600DFFB61BA79D845B9773EAEF02320F21982DF44ADA252DA31AC80CF64

Function 0069B8BB Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0069B8DC
GetClassNameW.USER32(00000000,?,00000800), ref: 0069B90B

Part of subcall function 00690B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0068AC99,?,?,?,0068AC48,?,-00000002,?,00000000,?), ref: 00690B16

GetWindowLongW.USER32(00000000,000000F0), ref: 0069B929
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0069B940
GetObjectW.GDI32(00000000,00000018,?), ref: 0069B953

Part of subcall function 00698B21: GetDC.USER32(00000000), ref: 00698B2D
Part of subcall function 00698B21: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00698B3C
Part of subcall function 00698B21: ReleaseDC.USER32(00000000,00000000), ref: 00698B4A

Part of subcall function 00698ADE: GetDC.USER32(00000000), ref: 00698AEA
Part of subcall function 00698ADE: GetDeviceCaps.GDI32(00000000,00000058), ref: 00698AF9
Part of subcall function 00698ADE: ReleaseDC.USER32(00000000,00000000), ref: 00698B07

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0069B97A
DeleteObject.GDI32(00000000), ref: 0069B981
GetWindow.USER32(00000000,00000002), ref: 0069B98A

Strings

STATIC, xrefs: 0069B911

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 37cab24798b377eb0e572220dc248b2e183bbd5852aa51545924bc0a3326d83a
Instruction ID: 07dc86365cbf2858c3bf228c40d4cf5876f7952a9fe7a5ba716b07de4263faad
Opcode Fuzzy Hash: 37cab24798b377eb0e572220dc248b2e183bbd5852aa51545924bc0a3326d83a
Instruction Fuzzy Hash: B12108B25502247FEF206BA4DD46FEE766FEF05710F005111FA01B6581CF744D8186BA

Function 006A621A Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A622E

Part of subcall function 006A59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?), ref: 006A59C8
Part of subcall function 006A59B2: GetLastError.KERNEL32(?,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?,?), ref: 006A59DA

_free.LIBCMT ref: 006A623A
_free.LIBCMT ref: 006A6245
_free.LIBCMT ref: 006A6250
_free.LIBCMT ref: 006A625B
_free.LIBCMT ref: 006A6266
_free.LIBCMT ref: 006A6271
_free.LIBCMT ref: 006A627C
_free.LIBCMT ref: 006A6287
_free.LIBCMT ref: 006A6295

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e41dffe83b81626b2baedc38543f9ea276ea2040534c7a67bc962984f80cd77a
Instruction ID: b65d978161120873905400ad574ec7768ed946ed95343adafa3df78a1390f492
Opcode Fuzzy Hash: e41dffe83b81626b2baedc38543f9ea276ea2040534c7a67bc962984f80cd77a
Instruction Fuzzy Hash: 6C117275111548EFDB41FF54C942C9A3BB6FF05360B0240A9F9898F222D631DE909F84

Function 006820D3 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

x%u, xrefs: 006825EB
;%u, xrefs: 00682408
xc%u, xrefs: 00682648

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: ed953414f58db6418be84a7ffce3af55e834e84d46e1f8dd0fba5246a765d298
Instruction ID: 3cbb4d93865655c12c3795413129b85a66f7bce4de0978cafe249666fa81e41c
Opcode Fuzzy Hash: ed953414f58db6418be84a7ffce3af55e834e84d46e1f8dd0fba5246a765d298
Instruction Fuzzy Hash: 5FF123716043825BDB14FB2488B9BEE779BAF91304F08476DFD858B383CA349949C766

Function 0069995E Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006812E7: GetDlgItem.USER32(00000000,00003021), ref: 0068132B
Part of subcall function 006812E7: SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

EndDialog.USER32(?,00000001), ref: 006999AE
SendMessageW.USER32(?,00000080,00000001,?), ref: 006999DB
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 006999F0
SetWindowTextW.USER32(?,?), ref: 00699A01
GetDlgItem.USER32(?,00000065), ref: 00699A0A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00699A1E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00699A30

Strings

LICENSEDLG, xrefs: 00699972

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: ba835b54c99395842feae43321458a4c5b5f60b4d12549ebe7b3c65ea6fd20f9
Instruction ID: 304cb3e3c6ecbcf7d6a540fed7c4fea92915b068be359c875926a3c66bfe784c
Opcode Fuzzy Hash: ba835b54c99395842feae43321458a4c5b5f60b4d12549ebe7b3c65ea6fd20f9
Instruction Fuzzy Hash: 412129716012047FEB116B69DD49E7B3B6FEB47B94F04000CF640A6990CB629C41D636

Function 006A6541 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006A65CC
__alldvrm.LIBCMT ref: 006A67CD
__alldvrm.LIBCMT ref: 006A67EF

Strings

>,j, xrefs: 006A654B
>,j, xrefs: 006A6557, 006A65B2, 006A65CB, 006A6751
>,j, xrefs: 006A678E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: >,j$>,j$>,j
API String ID: 1036877536-1053307531
Opcode ID: be6c9d0d7c1be526505d416ba69bbcf9729ec644743c8de63497f1cd699fda8f
Instruction ID: 1fc213c8f353aff4b562d425d951aba8ffc59976e3a8431324e1881738e91ec6
Opcode Fuzzy Hash: be6c9d0d7c1be526505d416ba69bbcf9729ec644743c8de63497f1cd699fda8f
Instruction Fuzzy Hash: 08A134729102869FDB21AF28C891BAEBBE6EF52314F1C41ADF4959B381C638DD41CB51

Function 0068927D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00689282
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 006892A5
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 006892C4

Part of subcall function 00690B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0068AC99,?,?,?,0068AC48,?,-00000002,?,00000000,?), ref: 00690B16

_swprintf.LIBCMT ref: 00689360

Part of subcall function 00683F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00683F3E

MoveFileW.KERNEL32(?,?), ref: 006893D5
MoveFileW.KERNEL32(?,?), ref: 00689411

Strings

rtmp%d, xrefs: 00689349

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: 7d32afbe6a7ebd4888a78b6f13f9c3bd34e35166b8643d4d886d114e55790f46
Instruction ID: af46dbde1fafe7de45b2e88c5e5fe006268eda2c62e08a9b5047b8962fe3efa7
Opcode Fuzzy Hash: 7d32afbe6a7ebd4888a78b6f13f9c3bd34e35166b8643d4d886d114e55790f46
Instruction Fuzzy Hash: 7D419371911158AADF60FB70CD44EEB77BEAF44381F4842A9B905E3142DA349B46CF74

Function 00697EE4 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,00698704,?), ref: 00697FB9
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000003,00000000,00000000), ref: 00697FDA
CreateStreamOnHGlobal.COMBASE(00000000,00000001,00000000), ref: 00698001

Strings

<html>, xrefs: 00697F28, 00697F61
</html>, xrefs: 00697F8B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00697F33
utf-8"></head>, xrefs: 00697F3E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-4209811716
Opcode ID: dc7dd12f95af2defeebec250c157a840662fea3b53f9735eec9f31e51c39ec32
Instruction ID: a16cf8d913a4fe0cae28e4c2d75d1abbdbcf9c69922b2cb6eed81708534c6fab
Opcode Fuzzy Hash: dc7dd12f95af2defeebec250c157a840662fea3b53f9735eec9f31e51c39ec32
Instruction Fuzzy Hash: 2B3113721183117EEB24BB64DC06FAB779EDF53720F10410EF511A62C1EFB4994587A9

Function 00697D95 Relevance: 12.1, APIs: 8, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00697DAE
GetTickCount.KERNEL32 ref: 00697DCC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00697DE2
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00697DF6
TranslateMessage.USER32(?), ref: 00697E01
DispatchMessageW.USER32(?), ref: 00697E0C
ShowWindow.USER32(?,00000005,?,00000000,?,?,?,?,00000000,00000000,00000000,<html>,00000006), ref: 00697EBC
SetWindowTextW.USER32(?,00000000), ref: 00697EC6

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Message$CountTickWindow$DispatchPeekShowTextTranslate
String ID:
API String ID: 4150546248-0
Opcode ID: dc22f0893b4cbb6be51a15102d5d3e250d088acbc033489fddda4aba95e8cc83
Instruction ID: 4de65d1cf381adfa7cf038646d3ea592e2b844e9a237e91a3c50e56d2f269121
Opcode Fuzzy Hash: dc22f0893b4cbb6be51a15102d5d3e250d088acbc033489fddda4aba95e8cc83
Instruction Fuzzy Hash: 01415C71208306AFDB14DFA5D88496B7BEEEF89704B00096DF545C7650DB31EC49CB62

Function 0068FE0E Relevance: 12.1, APIs: 8, Instructions: 117timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0068FE21

Part of subcall function 0068A930: GetVersionExW.KERNEL32(?), ref: 0068A955

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 0068FE4A
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 0068FE5C
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0068FE69
SystemTimeToFileTime.KERNEL32(?,?), ref: 0068FE7F
SystemTimeToFileTime.KERNEL32(?,?), ref: 0068FE8B
FileTimeToSystemTime.KERNEL32(?,?), ref: 0068FEC1
__aullrem.LIBCMT ref: 0068FF4B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 1eb578fdb17c4d9565b813d18c9e7de4e6814ea716410a1a78562854ddb5c373
Instruction ID: fca2ed2c2c959ce5adec70782acd223c0f87c7281d9cd48d69cbeaecce5e1a50
Opcode Fuzzy Hash: 1eb578fdb17c4d9565b813d18c9e7de4e6814ea716410a1a78562854ddb5c373
Instruction Fuzzy Hash: 48413DB24083059FC714EF65C8809ABFBF9FF88714F004A2EF69692650E735E548DB56

Function 006AC56D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,006ACCE2,00000000,00000000,00000000,00000000,00000000,?), ref: 006AC5AF
__fassign.LIBCMT ref: 006AC62A
__fassign.LIBCMT ref: 006AC645
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 006AC66B
WriteFile.KERNEL32(?,00000000,00000000,006ACCE2,00000000,?,?,?,?,?,?,?,?,?,006ACCE2,00000000), ref: 006AC68A
WriteFile.KERNEL32(?,00000000,00000001,006ACCE2,00000000,?,?,?,?,?,?,?,?,?,006ACCE2,00000000), ref: 006AC6C3

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 48c8829f953bd09edd171ad85b61fa7dd8be8c2189401447b55bd00a2db58d51
Instruction ID: 5bbbf8a0ea9508c56eb32188c64406856e2395cc8355677a916311d44e7f438a
Opcode Fuzzy Hash: 48c8829f953bd09edd171ad85b61fa7dd8be8c2189401447b55bd00a2db58d51
Instruction Fuzzy Hash: 7B51AFB09002099FDB10DFA8D885AEEBBFAEF1A310F14515AE551E7251E730E941CF65

Function 0069B0D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0069B0EE
_swprintf.LIBCMT ref: 0069B122

Part of subcall function 00683F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00683F3E

SetDlgItemTextW.USER32(?,00000066,006C3122), ref: 0069B142
_wcschr.LIBVCRUNTIME ref: 0069B175
EndDialog.USER32(?,00000001), ref: 0069B256

Strings

%s%s%u, xrefs: 0069B117

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: 43cd5e157f3caad478fdfc6d1d3e0ffc5f210658e9336b57f6191ded97ead9bd
Instruction ID: c28f05b38c526bc0f88cdf8b73c14e7e40b8b81a7135dea8107ad595abf7af88
Opcode Fuzzy Hash: 43cd5e157f3caad478fdfc6d1d3e0ffc5f210658e9336b57f6191ded97ead9bd
Instruction Fuzzy Hash: 3941B27190021DAEEF61DBA0DE85EEE77BEEB04700F0450AAF508E6551EF719B848F64

Function 0068C96F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0068C9F5
_strlen.LIBCMT ref: 0068CA25
_swprintf.LIBCMT ref: 0068CA46
_wcschr.LIBVCRUNTIME ref: 0068CA6F
_wcsrchr.LIBVCRUNTIME ref: 0068CABB

Strings

%08x, xrefs: 0068CA3A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcsrchr
String ID: %08x
API String ID: 1593746830-3682738293
Opcode ID: 379c3eb59a2bbbfec7eb26aee42a06d0350301c5783ae41bb6cf36c9ea8e3390
Instruction ID: f78a9e55604bd1fc12c7c5b2e854b3931d1ee0539f399087fd54f73d29d54e8a
Opcode Fuzzy Hash: 379c3eb59a2bbbfec7eb26aee42a06d0350301c5783ae41bb6cf36c9ea8e3390
Instruction Fuzzy Hash: C341E472904354AAEB34F624CC49EFB77DEEB89320F04062AF94597242E6749D45C3B6

Function 0069859B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 006985B4
GetWindowRect.USER32(?,?), ref: 006985D9
ShowWindow.USER32(?,00000005,?), ref: 00698670
SetWindowTextW.USER32(?,00000000), ref: 00698678
ShowWindow.USER32(00000000,00000005), ref: 0069868E

Strings

RarHtmlClassName, xrefs: 0069863A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 0b9a86737379ba0985e8786a8595b40457242dffb6f36444ae97d1f0f0d04e2c
Instruction ID: 3755baa76186566075471f476b86fc7bc5a8c3ece809c97c1a2524c33501dbf2
Opcode Fuzzy Hash: 0b9a86737379ba0985e8786a8595b40457242dffb6f36444ae97d1f0f0d04e2c
Instruction Fuzzy Hash: 6A318F72104310AFCB219FA4DD48F5BBFAEEF49701F044559FD59AA292DB30E940CBA2

Function 006A9300 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006A92C4: _free.LIBCMT ref: 006A92ED

_free.LIBCMT ref: 006A934E

Part of subcall function 006A59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?), ref: 006A59C8
Part of subcall function 006A59B2: GetLastError.KERNEL32(?,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?,?), ref: 006A59DA

_free.LIBCMT ref: 006A9359
_free.LIBCMT ref: 006A9364
_free.LIBCMT ref: 006A93B8
_free.LIBCMT ref: 006A93C3
_free.LIBCMT ref: 006A93CE
_free.LIBCMT ref: 006A93D9

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f1ac33a155eeba0822e17f5f402666ce6a004e9925b6c7aeea596f78182db2dd
Instruction ID: c450a439c2ead3036be87d97d69a432bc1d7ee9a05cb81b36000bf6c6372a8aa
Opcode Fuzzy Hash: f1ac33a155eeba0822e17f5f402666ce6a004e9925b6c7aeea596f78182db2dd
Instruction Fuzzy Hash: 26116031551B04F6DA70F7B0CC47FCB779E9F02710F40481CB29A6A092D664FE444E64

Function 006A0BB4 Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006A0BAB,0069E602), ref: 006A0BC2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006A0BD0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006A0BE9
SetLastError.KERNEL32(00000000,?,006A0BAB,0069E602), ref: 006A0C3B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 98f5469ba3d838a4a4c9edb04cfdc25ea45a2297d0e211462955c37f418a5392
Instruction ID: 93d9e4ca7aaad7eb4e0b3550bfd1a52c801c1ff4a3eae7b935842283dd949c6f
Opcode Fuzzy Hash: 98f5469ba3d838a4a4c9edb04cfdc25ea45a2297d0e211462955c37f418a5392
Instruction Fuzzy Hash: C80124722292126EF7A036B8AC855A76A5BEF177B4B20032EF521452F1EF214C829915

Function 0069C7FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 0069C816
ReleaseSRWLockExclusive, xrefs: 0069C83B
AcquireSRWLockExclusive, xrefs: 0069C82B

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: d0d152108bd2683c4065d43b74c99ff8510c734da8b978ea138b6f212af83cb5
Instruction ID: f9a2c96d1cdfe12316a28ba8a2bd8529c1c74e659a1d5d0a4d5b077ae695c723
Opcode Fuzzy Hash: d0d152108bd2683c4065d43b74c99ff8510c734da8b978ea138b6f212af83cb5
Instruction Fuzzy Hash: 3F01F9B1F62221A7DF205EB55DA46E72F8F5A037B1311213AD511D7B50D710C882A7A0

Function 0069003E Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 0069009C

Part of subcall function 0068A930: GetVersionExW.KERNEL32(?), ref: 0068A955

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006900BE
FileTimeToSystemTime.KERNEL32(?,?), ref: 006900D8
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 006900E9
SystemTimeToFileTime.KERNEL32(?,?), ref: 006900F9
SystemTimeToFileTime.KERNEL32(?,?), ref: 00690105

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 98e4c11ad9c91514a954836c593d6a2ac104c3b0b50bdbed985a35950162d68d
Instruction ID: 2788d55c7f4f016438b230f0f1a2d505768a75c384564f9e4d3431479a983161
Opcode Fuzzy Hash: 98e4c11ad9c91514a954836c593d6a2ac104c3b0b50bdbed985a35950162d68d
Instruction Fuzzy Hash: EC31C47A1083459ED704DFA9C88099BB7EDFF98704F045A1EF999C3210E634D549CB6A

Function 0069820D Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00698231
_memcmp.LIBVCRUNTIME ref: 00698248

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: eab70ede157d4bf01fffb96af972d756eff0b5afc0d1c801b369e5343bd2d814
Instruction ID: 98b9229f4d4184183b8101af359a160b181847aaf55f02676187a6570af7d73c
Opcode Fuzzy Hash: eab70ede157d4bf01fffb96af972d756eff0b5afc0d1c801b369e5343bd2d814
Instruction Fuzzy Hash: AB21C5B160050ABFDF04AB50DC82EBB77AEAF52758B10812DFC059BA06EB31DE4597D4

Function 006A630E Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,006BCBE8,006A2664,006BCBE8,?,?,006A2203,?,?,006BCBE8), ref: 006A6312
_free.LIBCMT ref: 006A6345
_free.LIBCMT ref: 006A636D
SetLastError.KERNEL32(00000000,?,006BCBE8), ref: 006A637A
SetLastError.KERNEL32(00000000,?,006BCBE8), ref: 006A6386
_abort.LIBCMT ref: 006A638C

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 36c1c65a81556624bc8b4ee89c8c6e90f2004f2ef6ae7ba695475465fa7c90f5
Instruction ID: b039ea4500fd849e64838c776b7c3af47add1d41390b7a18c7963349c442d480
Opcode Fuzzy Hash: 36c1c65a81556624bc8b4ee89c8c6e90f2004f2ef6ae7ba695475465fa7c90f5
Instruction Fuzzy Hash: 5BF0F47520990066DB517B64AC0AB9B26278BC3731B29131DF525D23A1FF618C434959

Function 0069A8D3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00001000), ref: 0069A92B
CharUpperW.USER32(?,?,?,?,?,00001000), ref: 0069A952

Strings

*al, xrefs: 0069A99B
-, xrefs: 0069A919

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CharUpper
String ID: *al$-
API String ID: 9403516-993255241
Opcode ID: 90e63b6ce339952680c31a83849bf32919ce498741fb24a10c4fbde0cd53e439
Instruction ID: fd380ad915fc13102272fc1fe103043b186fdc4e46b0cc36e57598db1348211a
Opcode Fuzzy Hash: 90e63b6ce339952680c31a83849bf32919ce498741fb24a10c4fbde0cd53e439
Instruction Fuzzy Hash: 5F21B17241430599DF21AAED880CBB6B6EFBB95310F06491FF595C2E41DA74C888E3E7

Function 0069B81F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 006812E7: GetDlgItem.USER32(00000000,00003021), ref: 0068132B
Part of subcall function 006812E7: SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

EndDialog.USER32(?,00000001), ref: 0069B86A
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0069B880
SetDlgItemTextW.USER32(?,00000065,?), ref: 0069B89A
SetDlgItemTextW.USER32(?,00000066), ref: 0069B8A5

Strings

RENAMEDLG, xrefs: 0069B837

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 26aee160384298328c76e56197190048235825cb16369b44a5ef897c48dee21c
Instruction ID: f5657905244873092e5633d906e6699842b859a4002960c1ff9d8e5abd6512c4
Opcode Fuzzy Hash: 26aee160384298328c76e56197190048235825cb16369b44a5ef897c48dee21c
Instruction Fuzzy Hash: 98014532A40204BAD6114EA9BF48F773B6EA78AB51F001416F240B79D0C3A698019B72

Function 006A4A7F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006A4A30,?,?,006A49D0,?,006B7F60,0000000C,006A4B27,?,00000002), ref: 006A4A9F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006A4AB2
FreeLibrary.KERNEL32(00000000,?,?,?,006A4A30,?,?,006A49D0,?,006B7F60,0000000C,006A4B27,?,00000002,00000000), ref: 006A4AD5

Strings

CorExitProcess, xrefs: 006A4AAA
mscoree.dll, xrefs: 006A4A98

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 82130617e5a62608c3a4bc7cacd50497c382d351468c94b840a4949862261ffb
Instruction ID: fd875797cbd32e330260bf693923a3e150e44534f06d373a606386fbfc81ce67
Opcode Fuzzy Hash: 82130617e5a62608c3a4bc7cacd50497c382d351468c94b840a4949862261ffb
Instruction Fuzzy Hash: 0BF0AF71A40209BBDB05AFD4DC19BDEBFFAEF44711F044268F905A6250DB709E80CB94

Function 0068DF05 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0068F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0068F376
Part of subcall function 0068F35B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0068DF18,Crypt32.dll,?,0068DF9C,?,0068DF7E,?,?,?,?), ref: 0068F398

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0068DF24
GetProcAddress.KERNEL32(006C1E58,CryptUnprotectMemory), ref: 0068DF34

Strings

Crypt32.dll, xrefs: 0068DF0E
CryptProtectMemory, xrefs: 0068DF1E
CryptUnprotectMemory, xrefs: 0068DF2A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 03abd9ee1d1d9fd118c20347e29b848ec20e9e691638efc2eb7ac3d9e76c29af
Instruction ID: 0231a5402eb3f9ba441449ad90056173f0b1122040a6881ce989e13ac1339311
Opcode Fuzzy Hash: 03abd9ee1d1d9fd118c20347e29b848ec20e9e691638efc2eb7ac3d9e76c29af
Instruction Fuzzy Hash: 68E04FF0518742AEEB406B349809B86FF967B94710F058255F119C2281E7B4D0E49B50

Function 006A52C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006A5333
_free.LIBCMT ref: 006A5353

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 695caba297515b49a3e4c37681c3bbada51fa49ba84ee1ffb47e2380c34583d4
Instruction ID: bb83b718ed99acf20ee9b649a90745ff9f2c03a9e2311a4d8540cd91b5f32b8d
Opcode Fuzzy Hash: 695caba297515b49a3e4c37681c3bbada51fa49ba84ee1ffb47e2380c34583d4
Instruction Fuzzy Hash: FD419572A006009FCF14EF79C881A9EB7B6EF8A314F1545A9E516EB351E671AD01CF80

Function 006A89A0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 006A89A9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006A89CC

Part of subcall function 006A59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,006A239A,?,0000015D,?,?,?,?,006A2F19,000000FF,00000000,?,?), ref: 006A5A1E

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 006A89F2
_free.LIBCMT ref: 006A8A05
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006A8A14

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 4873ef04d4acc69e0ac4c5323f8db4a296c1d7c8f05dd0b7f42737978826f179
Instruction ID: 44f82cd514f0a7a91ada44533048447dfc36cdddec32bcdfe3b64031772786e6
Opcode Fuzzy Hash: 4873ef04d4acc69e0ac4c5323f8db4a296c1d7c8f05dd0b7f42737978826f179
Instruction Fuzzy Hash: 4B0184B26026557F272176BA6C4DCBB6D7FEFC7FA1315022AFA05D7201EE608C0189B1

Function 006A6392 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,006A5E33,006A5ACF,?,006A633C,00000001,00000364,?,006A2203,?,?,006BCBE8), ref: 006A6397
_free.LIBCMT ref: 006A63CC
_free.LIBCMT ref: 006A63F3
SetLastError.KERNEL32(00000000,?,006BCBE8), ref: 006A6400
SetLastError.KERNEL32(00000000,?,006BCBE8), ref: 006A6409

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 0a8e62ba31f16ed6f82b07ad692f13a1e3b0e19008578a925a95a62b678e0dbf
Instruction ID: 67b41a3e391507ffb8073fd5be40e77995925ebe6c00b3ec91fe97196199b528
Opcode Fuzzy Hash: 0a8e62ba31f16ed6f82b07ad692f13a1e3b0e19008578a925a95a62b678e0dbf
Instruction Fuzzy Hash: 840149B2105A00679B127764AC85A6B176BCBD337172A522DF41592392EF74CC034925

Function 006A925B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006A9273

Part of subcall function 006A59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?), ref: 006A59C8
Part of subcall function 006A59B2: GetLastError.KERNEL32(?,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?,?), ref: 006A59DA

_free.LIBCMT ref: 006A9285
_free.LIBCMT ref: 006A9297
_free.LIBCMT ref: 006A92A9
_free.LIBCMT ref: 006A92BB

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 22c49ac05db2eec11fb8e9905609a399c29235ed97a2adf4b4fcea92880372fd
Instruction ID: 14f224929f173c179e85207ebabf75fa03c604d74cf6f157d622caba6e848b06
Opcode Fuzzy Hash: 22c49ac05db2eec11fb8e9905609a399c29235ed97a2adf4b4fcea92880372fd
Instruction Fuzzy Hash: 28F0FF72516640FB9A60FB98E8C2D5677EBEA027207655909F409DBA02C625FDC04E64

Function 006A5513 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A5531

Part of subcall function 006A59B2: RtlFreeHeap.NTDLL(00000000,00000000,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?), ref: 006A59C8
Part of subcall function 006A59B2: GetLastError.KERNEL32(?,?,006A92F2,?,00000000,?,00000000,?,006A9319,?,00000007,?,?,006A9716,?,?), ref: 006A59DA

_free.LIBCMT ref: 006A5543
_free.LIBCMT ref: 006A5556
_free.LIBCMT ref: 006A5567
_free.LIBCMT ref: 006A5578

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 72cbbaa9539f71b7515b737daa2ea4a044c110dedbde9681f1563941a5ee9d46
Instruction ID: 625824b93500cc44340d18d9ac5a56d939ae87de2a70bdc39774d0a2c28467a6
Opcode Fuzzy Hash: 72cbbaa9539f71b7515b737daa2ea4a044c110dedbde9681f1563941a5ee9d46
Instruction Fuzzy Hash: 0AF01DB4C17510DB9B51BF58BC0144A3B73FB0A720343224BF41596266D7244C819F87

Function 006A4B7A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\dfbzdfb.exe,00000104), ref: 006A4BBA
_free.LIBCMT ref: 006A4C85
_free.LIBCMT ref: 006A4C8F

Strings

C:\Users\user\AppData\Local\Temp\dfbzdfb.exe, xrefs: 006A4BB1, 006A4BB8, 006A4BE7, 006A4C1F

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\dfbzdfb.exe
API String ID: 2506810119-3557689370
Opcode ID: 86e4c088fca9f78a52661a66a149de7d3b7a96469564c5a9858c7ec597c19140
Instruction ID: b293020f8052d0bdfb5dffd9a4d5f4dcccd9ce637db549c7096ddc51e1316062
Opcode Fuzzy Hash: 86e4c088fca9f78a52661a66a149de7d3b7a96469564c5a9858c7ec597c19140
Instruction Fuzzy Hash: D0317371A01258EFDB61EB999C8199EBBFEEFC6720B11406AF40997311DBB08E40DF50

Function 00687463 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00687468

Part of subcall function 00683A90: __EH_prolog.LIBCMT ref: 00683A95

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000), ref: 0068752E

Part of subcall function 00687A9D: GetCurrentProcess.KERNEL32(00000020,?), ref: 00687AAC
Part of subcall function 00687A9D: GetLastError.KERNEL32 ref: 00687AF2
Part of subcall function 00687A9D: CloseHandle.KERNEL32(?), ref: 00687B01

Strings

SeSecurityPrivilege, xrefs: 006874AC
SeRestorePrivilege, xrefs: 006874C1

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 0fe0bd4cbb468b1e4f2ea3543f5720cb0ac9f1d1d5ce50d53506432d8e0d730b
Instruction ID: 93c0e50388a6d2a14d20456c4355a88296cd19a8f87eb23c729a80e66d904556
Opcode Fuzzy Hash: 0fe0bd4cbb468b1e4f2ea3543f5720cb0ac9f1d1d5ce50d53506432d8e0d730b
Instruction Fuzzy Hash: 4331D5B1904208AEDF60FFA4DC02BEE7FABEF55310F104229F545A7242DB708B848766

Function 00699122 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 006812E7: GetDlgItem.USER32(00000000,00003021), ref: 0068132B
Part of subcall function 006812E7: SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

EndDialog.USER32(?,00000001), ref: 006991AA
GetDlgItemTextW.USER32(?,00000065,00000000,?), ref: 006991BF
SetDlgItemTextW.USER32(?,00000065,?), ref: 006991D4

Strings

ASKNEXTVOL, xrefs: 0069913A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 5331662dfb3d70b181918c8addc02a5af471dacc8bb841c6f5705258b4b6fa7e
Instruction ID: c9d6cf8e68299c8453b2abbed9d543134632f6e2ecaae04d1e1c7fba7b8352ca
Opcode Fuzzy Hash: 5331662dfb3d70b181918c8addc02a5af471dacc8bb841c6f5705258b4b6fa7e
Instruction Fuzzy Hash: 37119332645212BFDB119BA8DD4DFA63BAFFB46701F00401AF2009BAA1C26299469776

Function 0069BFA9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,?,00699645,?,?), ref: 0069C021

Strings

*al, xrefs: 0069C064
GETPASSWORD1, xrefs: 0069C016
*al, xrefs: 0069BFC7

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: DialogParam
String ID: *al$*al$GETPASSWORD1
API String ID: 665744214-713251149
Opcode ID: 1d4b14c94db6460941d0379826fa076616bcf6428e56765a9bda35c376757dc1
Instruction ID: 2750ebee723ed0c0bb66b53c2ce7771c84662fc5a7225882ecdb83baf8995a24
Opcode Fuzzy Hash: 1d4b14c94db6460941d0379826fa076616bcf6428e56765a9bda35c376757dc1
Instruction Fuzzy Hash: DD113832654204ABEF21DE24AC05FFB3B8FB70A761F040169FD08A75C1D6B55C80D7A8

Function 00699645 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 006812E7: GetDlgItem.USER32(00000000,00003021), ref: 0068132B
Part of subcall function 006812E7: SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

EndDialog.USER32(?,00000001), ref: 00699693
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 006996AB
SetDlgItemTextW.USER32(?,00000066,?), ref: 006996D9

Strings

GETPASSWORD1, xrefs: 0069965E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 47138cfd511f1a6625dd61a5e388ceafa9616ee5c71eea575796970d20781897
Instruction ID: 859a54652515583b7c1399d6b263f5ddeb5e68dc6ca320d11aae5274362f64b2
Opcode Fuzzy Hash: 47138cfd511f1a6625dd61a5e388ceafa9616ee5c71eea575796970d20781897
Instruction Fuzzy Hash: AF11083290011877EF215EB89D49FFB377EEB4A700F100119FA04F7680C2A69D5187B5

Function 0068B150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0068B177

Part of subcall function 00683F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00683F3E

_wcschr.LIBVCRUNTIME ref: 0068B195
_wcschr.LIBVCRUNTIME ref: 0068B1A5

Strings

%c:\, xrefs: 0068B16D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: cf8d2538260de2e345e330e9aca8ebe9d5f88f728a410e3f62c0356e235be192
Instruction ID: d1d2b35df6a2d4aac9fb61efee24f591666e99594ac32552a78384c5784b1a21
Opcode Fuzzy Hash: cf8d2538260de2e345e330e9aca8ebe9d5f88f728a410e3f62c0356e235be192
Instruction Fuzzy Hash: 1A01F563500311B9DA307B259C4ADABABEEEE96360714560EFD84DA682FB20D85087B5

Function 0068F982 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,00000000,006C1E74,?,?,0068FB9D,00000020,?,0068A812,?,0068C79B,?,00000000,?,00000001,?), ref: 0068F9BB
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,0068A812,?,0068C79B,?,00000000,?,00000001,?,?,?,00693AFE), ref: 0068F9C5
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,0068A812,?,0068C79B,?,00000000,?,00000001,?,?,?,00693AFE), ref: 0068F9D5

Strings

Thread pool initialization failed., xrefs: 0068F9ED

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 1a498f4e00544f3a6cde616f0010448d9dcbe946e37f5082e32320744158b6af
Instruction ID: 3ca7132d79752e040655ed2fe822520d10d1b73c841c87d93a9c797587b58a3b
Opcode Fuzzy Hash: 1a498f4e00544f3a6cde616f0010448d9dcbe946e37f5082e32320744158b6af
Instruction Fuzzy Hash: B61130B1640705AFD7306F65D889AE7FBEDFF95355F10492EF2DA82200DA716880CB20

Function 0069BEE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0069BF41
REPLACEFILEDLG, xrefs: 0069BF2B, 0069BF5D

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: efec08843256b3c6013b56ba62ddf675636e611e81dc9d1cd81b1d6840fafaa6
Instruction ID: ac2355db2afdbb414329cfb16c2e2cda018a7e836ddac6bf8afdb87651a7ffb5
Opcode Fuzzy Hash: efec08843256b3c6013b56ba62ddf675636e611e81dc9d1cd81b1d6840fafaa6
Instruction Fuzzy Hash: 05019EB2609202AFCB008B58FE50E76BBDFE789390F052526F94192A30E7219C45DF66

Function 0068CE98 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0068CEA7
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0068CEB6

Strings

LTR, xrefs: 0068CEC6, 0068CED1, 0068CEDA
RTL, xrefs: 0068CEAF, 0068CEB4, 0068CEE8

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: 20925636a36cbd2642ecccbb90b233659e688a6e41ade57980a5e5381d68fcbd
Instruction ID: 61c115a2b35b6715168f1ebd4101b110516aaf76a6be7fbbbc85fd0c7c9e9d5a
Opcode Fuzzy Hash: 20925636a36cbd2642ecccbb90b233659e688a6e41ade57980a5e5381d68fcbd
Instruction Fuzzy Hash: 53F0F06165425467E7347A686C0AFA73FAEE785B10F0007ADB606961C0EAA0998987B4

Function 0069BE09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0069BE1F
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0069BE5B

Strings

sfxcmd, xrefs: 0069BE1A
sfxpar, xrefs: 0069BE56

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 224ec74281e7def9ec58ab63700b1da061e3e5aaada9adcf725a677099932596
Instruction ID: 8dc7d6a0208cc4f8d60e3913b430f27f11feb9a98421c1e8f4e0ccb8e59062dd
Opcode Fuzzy Hash: 224ec74281e7def9ec58ab63700b1da061e3e5aaada9adcf725a677099932596
Instruction Fuzzy Hash: A1F0A7B2401224AADB652BD59C09BEB7B9FDF04B91B000115FE486A241D7618880C7A1

Function 00689F7A Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,00687F55,?,?,?), ref: 0068A020
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,00687F55,?,?), ref: 0068A064
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,00687F55,?,?,?,?,?,?,?,?), ref: 0068A0E5
CloseHandle.KERNEL32(?,?,00000000,?,00687F55,?,?,?,?,?,?,?,?,?,?,?), ref: 0068A0EC

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: b79b607810ad17df86e8c4b3f6b8da856b5c8ebe46fb43cf169b9c8fc9f6ec03
Instruction ID: 0c7b2347eba9a9a8604531038a4bd9af148014c762f123ea794fbc375325252b
Opcode Fuzzy Hash: b79b607810ad17df86e8c4b3f6b8da856b5c8ebe46fb43cf169b9c8fc9f6ec03
Instruction Fuzzy Hash: 6641D0312483805AE731EF64DC45BEFBBEAAB85704F080A1DF9D1D3281C664DA48CB63

Function 006A93E4 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,F5E85006,006A2784,00000000,00000000,006A2FB2,?,006A2FB2,?,00000001,006A2784,F5E85006,00000001,006A2FB2,006A2FB2), ref: 006A9431
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006A94BA
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 006A94CC
__freea.LIBCMT ref: 006A94D5

Part of subcall function 006A59EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,006A239A,?,0000015D,?,?,?,?,006A2F19,000000FF,00000000,?,?), ref: 006A5A1E

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: d07182c03b8d183a6b3fe830423fbdb1621b2486f4fd068eaf715d34be68c194
Instruction ID: 063b9c6522abcc9dda50c00c33c87814dc02893ceb2ba15bea30917588af875b
Opcode Fuzzy Hash: d07182c03b8d183a6b3fe830423fbdb1621b2486f4fd068eaf715d34be68c194
Instruction Fuzzy Hash: 6F31BF72A0020AABDF25EF68CC41DEE7BE6EB05310F144268FC049B291E735CD51CBA0

Function 00699A75 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00699A85
GetObjectW.GDI32(00000000,00000018,?), ref: 00699AA6
DeleteObject.GDI32(00000000), ref: 00699ACE
DeleteObject.GDI32(00000000), ref: 00699AED

Part of subcall function 00698BCF: FindResourceW.KERNEL32(00000066,PNG,?,?,00699AC7,00000066), ref: 00698BE0
Part of subcall function 00698BCF: SizeofResource.KERNEL32(00000000,75755780,?,?,00699AC7,00000066), ref: 00698BF8
Part of subcall function 00698BCF: LoadResource.KERNEL32(00000000,?,?,00699AC7,00000066), ref: 00698C0B
Part of subcall function 00698BCF: LockResource.KERNEL32(00000000,?,?,00699AC7,00000066), ref: 00698C16

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: a6d12ddec81cbefbb322a0b3a30341bfcff89f3212b5042ead3937ffc742a3b9
Instruction ID: e5d3f62c440d8957f078b2120deccf17beff237949f0850c65ac26f3c38a0e16
Opcode Fuzzy Hash: a6d12ddec81cbefbb322a0b3a30341bfcff89f3212b5042ead3937ffc742a3b9
Instruction Fuzzy Hash: 0601F2735402152BCF1177B88D42EBE766FEF86B61F490119BE00A7B91DE618C1192B5

Function 006A0FD6 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 006A0FED

Part of subcall function 006A1625: ___AdjustPointer.LIBCMT ref: 006A166F

_UnwindNestedFrames.LIBCMT ref: 006A1004
___FrameUnwindToState.LIBVCRUNTIME ref: 006A1016
CallCatchBlock.LIBVCRUNTIME ref: 006A103A

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: b9fa4c2ca776b65944230fb083eb0fa8b0de912ee33a1d220a96a688825d65b2
Instruction ID: 64f875ce58b31c0d81b3090319ff875d13778306d129dbcd318f8b35f9ec2305
Opcode Fuzzy Hash: b9fa4c2ca776b65944230fb083eb0fa8b0de912ee33a1d220a96a688825d65b2
Instruction Fuzzy Hash: 8E012932400149BBCF22AF55CC01EDA3FBBEF5A754F044018FA1865121C776E8A1EFA4

Function 0068FB54 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0068FB59
EnterCriticalSection.KERNEL32(006C1E74,?,?,0068A812,?,0068C79B,?,00000000,?,00000001,?,?,?,00693AFE,?,00008000), ref: 0068FB66
new.LIBCMT ref: 0068FB82

Part of subcall function 0068F982: InitializeCriticalSection.KERNEL32(000001A0,00000000,006C1E74,?,?,0068FB9D,00000020,?,0068A812,?,0068C79B,?,00000000,?,00000001,?), ref: 0068F9BB
Part of subcall function 0068F982: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,0068A812,?,0068C79B,?,00000000,?,00000001,?,?,?,00693AFE), ref: 0068F9C5
Part of subcall function 0068F982: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,0068A812,?,0068C79B,?,00000000,?,00000001,?,?,?,00693AFE), ref: 0068F9D5

LeaveCriticalSection.KERNEL32(006C1E74,?,0068A812,?,0068C79B,?,00000000,?,00000001,?,?,?,00693AFE,?,00008000,?), ref: 0068FBA3

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CriticalSection$Create$EnterEventH_prologInitializeLeaveSemaphore
String ID:
API String ID: 3780591329-0
Opcode ID: 759cec63988e0fa714172c39bad7be99bfebfc31d79d311efb149ce312a15ee8
Instruction ID: 5024ee669b88f4415ee344f2ef043f2d204d5b50a32d9d39739942a7d02262f1
Opcode Fuzzy Hash: 759cec63988e0fa714172c39bad7be99bfebfc31d79d311efb149ce312a15ee8
Instruction Fuzzy Hash: 8BF06274A012119BDB44AF68D811FB97AABEB4F310B00513EE809D7351DB7188008B54

Function 006A0B06 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 006A0B06
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 006A0B0B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 006A0B10

Part of subcall function 006A1BDE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 006A1BEF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 006A0B25

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 531e6f4e0a03c94a47563f5691ee99a7aac98bf87a5ed1e2fb88b7d1485fc598
Instruction ID: 9c1ff915f632d7a502aa7074dffcd1eeb0b94f1b8c190eea58764340ea03c86e
Opcode Fuzzy Hash: 531e6f4e0a03c94a47563f5691ee99a7aac98bf87a5ed1e2fb88b7d1485fc598
Instruction Fuzzy Hash: FAC048146442E5A83CE43BB123021EE13832CA3BDCF8415C9A8521F207AA5B0C4B6C3F

Function 00698CF2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00698BA4: GetDC.USER32(00000000), ref: 00698BA8
Part of subcall function 00698BA4: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00698BB3
Part of subcall function 00698BA4: ReleaseDC.USER32(00000000,00000000), ref: 00698BBE

GetObjectW.GDI32(?,00000018,?), ref: 00698D23

Part of subcall function 00698EE9: GetDC.USER32(00000000), ref: 00698EF2
Part of subcall function 00698EE9: GetObjectW.GDI32(?,00000018,?), ref: 00698F21
Part of subcall function 00698EE9: ReleaseDC.USER32(00000000,?), ref: 00698FB5

Strings

(, xrefs: 00698DEE

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 3edcba738cbe607a10c937c663b5fd3a31d53bec4c41984bde55c15e14668cd1
Instruction ID: 798dd09d3be336f4d1b35b68c4edca97984a49a9a49b44ba1fea4dc7010f2eb3
Opcode Fuzzy Hash: 3edcba738cbe607a10c937c663b5fd3a31d53bec4c41984bde55c15e14668cd1
Instruction Fuzzy Hash: F66113B1208214AFD714DF64C884E6BBBEEEF89704F10491DF599CB261DA31E809CB62

Function 006901CD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00690393

Strings

%ls, xrefs: 0069020C, 00690222
%s: %s, xrefs: 006903A2

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 1db946ca8020cec219ebe21a0f45b774bae837ef5cd635a2ee38cbf88c5a9047
Instruction ID: 5a02da8ef017320e40117366e10649974e0f551ab822af4e1bf524d81095889b
Opcode Fuzzy Hash: 1db946ca8020cec219ebe21a0f45b774bae837ef5cd635a2ee38cbf88c5a9047
Instruction Fuzzy Hash: 6451C835288300FEFF612B948D4EF35765FAB09F00F60850AF78A65CE5C5A2A651B71A

Function 006A7BD9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006A7D45

Part of subcall function 006A5D1D: IsProcessorFeaturePresent.KERNEL32(00000017,006A5D0C,0000002C,006B80C8,006A8D62,00000000,00000000,006A6391,?,?,006A5D19,00000000,00000000,00000000,00000000,00000000), ref: 006A5D1F
Part of subcall function 006A5D1D: GetCurrentProcess.KERNEL32(C0000417,006B80C8,0000002C,006A5A4A,00000016,006A6391), ref: 006A5D41
Part of subcall function 006A5D1D: TerminateProcess.KERNEL32(00000000), ref: 006A5D48

Strings

*?, xrefs: 006A7C1C
., xrefs: 006A7EFC

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 7b97f05bead931982e7a23c9cf534e270e960d3348eeadaf4e8a2cba3451af48
Instruction ID: 60eec163041c4ae5b4f520574c57ade8e00c7cd6d0e80773ae2d1c6bde12104a
Opcode Fuzzy Hash: 7b97f05bead931982e7a23c9cf534e270e960d3348eeadaf4e8a2cba3451af48
Instruction Fuzzy Hash: 27519E71E0420AAFDF14EFA8CC81AEDBBB6EF59314F24416AE855E7301E6719E018F54

Function 00687619 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0068761E
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00687799

Part of subcall function 0068A113: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00689F49,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 0068A127
Part of subcall function 0068A113: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00689F49,?,?,?,00689DE2,?,00000001,00000000,?,?), ref: 0068A158

Strings

:, xrefs: 0068768F

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 221673ed35cc672e9ec497e8ad67013492077bf2b70ade75e4d6521a1ca8f377
Instruction ID: 30477b9cc32a3285b104db60c3bae63152b065ea3dae383d4e0486d419bf1d2e
Opcode Fuzzy Hash: 221673ed35cc672e9ec497e8ad67013492077bf2b70ade75e4d6521a1ca8f377
Instruction Fuzzy Hash: 4B41E171804218AAEB64FB60CC59EEF777EEF44340F1402ADB645A2142DB749F85CFA4

Function 0068B2C5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

UNC, xrefs: 0068B361
\\?\, xrefs: 0068B317, 0068B353, 0068B3B4, 0068B407

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 7ae7c64971909728c5fdcb8f66dd05cc297ff3fe19986a2488d47833623453fd
Instruction ID: 272d7eed5dca05cbe65d0b4f874fa681737d159ac28487ec1e10da625ec3d9b3
Opcode Fuzzy Hash: 7ae7c64971909728c5fdcb8f66dd05cc297ff3fe19986a2488d47833623453fd
Instruction Fuzzy Hash: 2841D132400219AACF71BF20CC06EEF77ABEF05390F50572AF854A3146E7709A959BA5

Function 0069802C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00698039

Strings

Shell.Explorer, xrefs: 00698065
about:blank, xrefs: 006980D1

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 858476214d615ff745807f7da528c861c74a2bcf41cac9b6f04b06c5c4cc9b6d
Instruction ID: 9551c7ca371146dea54f4542daeb0dfe0393cc75604ebc2f49885020626b4789
Opcode Fuzzy Hash: 858476214d615ff745807f7da528c861c74a2bcf41cac9b6f04b06c5c4cc9b6d
Instruction Fuzzy Hash: 49216F75200706AFDF049B65C8A0E7AB76EBF86710B15852DF5058BA82CF71EC45CBA1

Function 0068DF86 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0068DF05: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0068DF24
Part of subcall function 0068DF05: GetProcAddress.KERNEL32(006C1E58,CryptUnprotectMemory), ref: 0068DF34

GetCurrentProcessId.KERNEL32(?,?,?,0068DF7E), ref: 0068E007

Strings

CryptUnprotectMemory failed, xrefs: 0068DFFF
CryptProtectMemory failed, xrefs: 0068DFC7

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: d462943a41914a768ca19769ab06b0fafe1c97485938137ab054d3f2f7ff7a53
Instruction ID: 0a1ab18607118a7928e848ae45c2dc27b4207611b1e1ab81fa0243951ea5ad92
Opcode Fuzzy Hash: d462943a41914a768ca19769ab06b0fafe1c97485938137ab054d3f2f7ff7a53
Instruction Fuzzy Hash: 1F115B707042156BEB21BB28DC00EBB379BDF8E750B044619F901DB292EBA1DD5143A0

Function 006812E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0068CF27: GetWindowRect.USER32(?,?), ref: 0068CF5E
Part of subcall function 0068CF27: GetClientRect.USER32(?,?), ref: 0068CF6A
Part of subcall function 0068CF27: GetWindowLongW.USER32(?,000000F0), ref: 0068D00B
Part of subcall function 0068CF27: GetWindowRect.USER32(?,?), ref: 0068D038
Part of subcall function 0068CF27: GetWindowTextW.USER32(?,?,00000400), ref: 0068D057

GetDlgItem.USER32(00000000,00003021), ref: 0068132B
SetWindowTextW.USER32(00000000,006B02E4), ref: 00681341

Strings

0, xrefs: 006812EA

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: Window$Rect$Text$ClientItemLong
String ID: 0
API String ID: 660763476-4108050209
Opcode ID: c69fe77da072e81a09f10a2f9cd8098c1e34f45825fe3f4e824a6b135e4f1e91
Instruction ID: e693a451ff0ae247f334271b375d3c84876a8bea5c123237a7a995941e058772
Opcode Fuzzy Hash: c69fe77da072e81a09f10a2f9cd8098c1e34f45825fe3f4e824a6b135e4f1e91
Instruction Fuzzy Hash: 23F0C8F0540248ABDF252F60DC09AE93F9F9F06754F084214FE4458591C774C6D2DB14

Function 0068FB19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,0068FCF9,?,?,0068FD6E,?,?,?,?,?,0068FD58), ref: 0068FB1F
GetLastError.KERNEL32(?,?,0068FD6E,?,?,?,?,?,0068FD58), ref: 0068FB2B

Part of subcall function 00686D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00686DAD

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 0068FB34

Memory Dump Source

Source File: 00000005.00000002.1470295606.0000000000681000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00680000, based on PE: true

Associated: 00000005.00000002.1469827294.0000000000680000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470339572.00000000006B0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470365086.00000000006DA000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.1470457648.00000000006DC000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_680000_dfbzdfb.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: d8415f0efa1362a8ee99424ce77a4e12c1eac193ffe7251b0cc8a3e527b3747f
Instruction ID: abd6429333da1976045f5cf69003d7daf6fda7e2403b3fb8b3d407d44edd27d8
Opcode Fuzzy Hash: d8415f0efa1362a8ee99424ce77a4e12c1eac193ffe7251b0cc8a3e527b3747f
Instruction Fuzzy Hash: DDD05EB1A4C43167EA413B28DC1AEFF3E0BAF52771F241B58F539A52F1DA2049C247A5

Analysis Process: zdfhrgzd.sfx.exePID: 4788, Parent PID: 4640COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1528
Total number of Limit Nodes:	33

Executed Functions

Function 0097C130 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096F3A5: GetModuleHandleW.KERNEL32 ref: 0096F3BD
Part of subcall function 0096F3A5: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0096F3D5
Part of subcall function 0096F3A5: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0096F3F8

Part of subcall function 00978B8D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00978B95

Part of subcall function 00979035: OleInitialize.OLE32(00000000), ref: 0097904E
Part of subcall function 00979035: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00979085
Part of subcall function 00979035: SHGetMalloc.SHELL32(009A20E8), ref: 0097908F

Part of subcall function 00970710: GetCPInfo.KERNEL32(00000000,?), ref: 00970721
Part of subcall function 00970710: IsDBCSLeadByte.KERNEL32(00000000), ref: 00970735

GetCommandLineW.KERNEL32 ref: 0097C178
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0097C19F
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0097C1B0
UnmapViewOfFile.KERNEL32(00000000), ref: 0097C1EA

Part of subcall function 0097BE09: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 0097BE1F
Part of subcall function 0097BE09: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0097BE5B

CloseHandle.KERNEL32(00000000), ref: 0097C1F3
GetModuleFileNameW.KERNEL32(00000000,009B7938,00000800), ref: 0097C20E
SetEnvironmentVariableW.KERNEL32(sfxname,009B7938), ref: 0097C220
GetLocalTime.KERNEL32(?), ref: 0097C227
_swprintf.LIBCMT ref: 0097C266
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0097C278
GetModuleHandleW.KERNEL32(00000000), ref: 0097C27B
LoadIconW.USER32(00000000,00000064), ref: 0097C292
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00019B4E,00000000), ref: 0097C2E3
Sleep.KERNEL32(?), ref: 0097C311
DeleteObject.GDI32 ref: 0097C350
DeleteObject.GDI32(?), ref: 0097C35C

Part of subcall function 0097A8D3: CharUpperW.USER32(?,?,?,?,00001000), ref: 0097A92B
Part of subcall function 0097A8D3: CharUpperW.USER32(?,?,?,?,?,00001000), ref: 0097A952

CloseHandle.KERNEL32 ref: 0097C39B

Strings

winrarsfxmappingfile.tmp, xrefs: 0097C193
sfxname, xrefs: 0097C21B
STARTDLG, xrefs: 0097C2D8
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0097C257
sfxstime, xrefs: 0097C273

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCharCloseDeleteObjectProcUpperView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 985665271-3710569615
Opcode ID: aef48a83a17b7af3dfe3f6a311a8819d519cad0e5d5e845e2f1393bf7045b315
Instruction ID: 5a4df5372811f47792050436e2214933d2246ca2e920a32cf3fd52833cf35c7b
Opcode Fuzzy Hash: aef48a83a17b7af3dfe3f6a311a8819d519cad0e5d5e845e2f1393bf7045b315
Instruction Fuzzy Hash: BF61E9B291C300AFD720ABA8AD49F6B37DCEFC9714F04842AF90892161DB758D04E7E1

Function 0096A2C3 Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,0096A1BE,000000FF,?,?), ref: 0096A2F8
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,0096A1BE,000000FF,?,?), ref: 0096A32E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0096A1BE,000000FF,?,?), ref: 0096A336
FindNextFileW.KERNEL32(?,?,?,?,?,?,0096A1BE,000000FF,?,?), ref: 0096A35E
GetLastError.KERNEL32(?,?,?,?,0096A1BE,000000FF,?,?), ref: 0096A36A

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: aa208f8a5de1dc3d01a8f53d8ec6ffdb2f1adca21c3f244b8b4b866b53c89afc
Instruction ID: ed87b1862e4ceb347b179319f6c787e509e6849c3df0b6c21fd3a6b59ca6aa7c
Opcode Fuzzy Hash: aa208f8a5de1dc3d01a8f53d8ec6ffdb2f1adca21c3f244b8b4b866b53c89afc
Instruction Fuzzy Hash: 3D414172608245AFC324DF68C885ADAF7E8BF89350F044A2AF5E9D3240D735A9548F92

Function 009849FA Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,009849D0,?,00997F60,0000000C,00984B27,?,00000002,00000000), ref: 00984A1B
TerminateProcess.KERNEL32(00000000,?,009849D0,?,00997F60,0000000C,00984B27,?,00000002,00000000), ref: 00984A22
ExitProcess.KERNEL32 ref: 00984A34

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5e543f360493271c1de618d45eea2c6f8a5116898c26643e95ab3ff79e78f456
Instruction ID: 4840b41dbc68f8cc56f92f134283e33740169054f5b7d0a229c6cb49dd988bd5
Opcode Fuzzy Hash: 5e543f360493271c1de618d45eea2c6f8a5116898c26643e95ab3ff79e78f456
Instruction Fuzzy Hash: BAE08C32064118AFCF11BF68DD09B883B69FF80342F000015F8198B232CB36DD92EB40

Function 0096F3A5 Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 0096F3BD
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0096F3D5
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0096F3F8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0096F6A3
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0096F6BB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0096F6CD
ReadFile.KERNEL32(00000000,?,00007FFE,00990858,00000000), ref: 0096F6EC
CloseHandle.KERNEL32(00000000), ref: 0096F744
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0096F75A
CompareStringW.KERNEL32(00000400,00001001,009908A4,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 0096F7B4
GetFileAttributesW.KERNEL32(?,?,00990870,00000800,?,00000000,?,00000800), ref: 0096F7DD
GetFileAttributesW.KERNEL32(?,?,00990930,00000800), ref: 0096F816

Part of subcall function 0096F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0096F376
Part of subcall function 0096F35B: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,0096DF18,Crypt32.dll,?,0096DF9C,?,0096DF7E,?,?,?,?), ref: 0096F398

_swprintf.LIBCMT ref: 0096F886
_swprintf.LIBCMT ref: 0096F8D2

Part of subcall function 00963F2B: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00963F3E

AllocConsole.KERNEL32 ref: 0096F8DA
GetCurrentProcessId.KERNEL32 ref: 0096F8E4
AttachConsole.KERNEL32(00000000), ref: 0096F8EB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 0096F911
WriteConsoleW.KERNEL32(00000000), ref: 0096F918
Sleep.KERNEL32(00002710), ref: 0096F923
FreeConsole.KERNEL32 ref: 0096F929
ExitProcess.KERNEL32 ref: 0096F931

Strings

DXGIDebug.dll, xrefs: 0096F435, 0096F7A0
SetDllDirectoryW, xrefs: 0096F3CF
SetDefaultDllDirectories, xrefs: 0096F3F2
kernel32, xrefs: 0096F3B3
dwmapi.dll, xrefs: 0096F460, 0096F849
uxtheme.dll, xrefs: 0096F853
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 0096F8C0

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: 991c5a793075d16ab2e07cc43557bb1e870ab1401dca10f58ab04722282eecef
Instruction ID: 4f22d903ffef0cbdd8fff76ee997c2e82a7f9e893db4421343f8f7a706ed0377
Opcode Fuzzy Hash: 991c5a793075d16ab2e07cc43557bb1e870ab1401dca10f58ab04722282eecef
Instruction Fuzzy Hash: 58D16FB15083849FDB30DF58D849B9FBBECEFC4304F50492DE5A996280D7B09548CBA2

Function 0097AA44 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 438
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0097AA49

Part of subcall function 009796EB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 009797B3

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,0097A35C,?,00000000), ref: 0097AB7E
GetFileAttributesW.KERNEL32(?), ref: 0097AC38
DeleteFileW.KERNEL32(?), ref: 0097AC46
SetWindowTextW.USER32(?,?), ref: 0097AD8F
_wcsrchr.LIBVCRUNTIME ref: 0097AF19
GetDlgItem.USER32(?,00000066), ref: 0097AF54
SetWindowTextW.USER32(00000000,?), ref: 0097AF64
SendMessageW.USER32(00000000,00000143,00000000,009A412A), ref: 0097AF78
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0097AFA1

Strings

, xrefs: 0097ACF2
Software\Microsoft\Windows\CurrentVersion, xrefs: 0097AE38
%s.%d.tmp, xrefs: 0097AC5E
ProgramFilesDir, xrefs: 0097AE63

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$ $ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-312220925
Opcode ID: c6217235f58e9e279cd3622fa45c8584069758b551a51dc0f7b9dadd4798259e
Instruction ID: 8c8515d2a0869c89e38c9e280b3ada4a1e942d42076464196fb39eb97a5974c3
Opcode Fuzzy Hash: c6217235f58e9e279cd3622fa45c8584069758b551a51dc0f7b9dadd4798259e
Instruction Fuzzy Hash: 5EE18F73904219AAEF25ABA4DD45EEE737CEF85350F1084A6F509E3081EF749B84CB61

Function 0097B9A9 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 0097BAD7
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 0097BB1C
GetExitCodeProcess.KERNEL32(?,?), ref: 0097BB54
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0097BB7A
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 0097BC09

Part of subcall function 00970B00: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0096AC99,?,?,?,0096AC48,?,-00000002,?,00000000,?), ref: 00970B16

Strings

.exe, xrefs: 0097BB84
, xrefs: 0097BA29
.inf, xrefs: 0097BA93

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 893814297ba6dbe68473ad788ae2c8afab0dc6d9a79df68df2664c4cea63f7ca
Instruction ID: 1f959035379ca8bf4466ee078877d56c96f7623329535a5b97a9bbb1444c5f55
Opcode Fuzzy Hash: 893814297ba6dbe68473ad788ae2c8afab0dc6d9a79df68df2664c4cea63f7ca
Instruction Fuzzy Hash: 4851D0325193809ADB31AF14D940BBBBBEDEF85704F08881DF9C993164EBB19D44DB92

Function 0098739F Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00982FB2,00982FB2,?,?,?,009875F0,00000001,00000001,F5E85006), ref: 009873F9
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,009875F0,00000001,00000001,F5E85006,?,?,?), ref: 0098747F
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,F5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00987579
__freea.LIBCMT ref: 00987586

Part of subcall function 009859EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,0098239A,?,0000015D,?,?,?,?,00982F19,000000FF,00000000,?,?), ref: 00985A1E

__freea.LIBCMT ref: 0098758F
__freea.LIBCMT ref: 009875B4

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f3c5ffa39e0392e77a4e85a815d72d529ca946410ab28080523550ea718f0312
Instruction ID: 44000d3f6f011a4bb692e4ebd18a6b97ad16ad2160f1eadf40d452a7016891cb
Opcode Fuzzy Hash: f3c5ffa39e0392e77a4e85a815d72d529ca946410ab28080523550ea718f0312
Instruction Fuzzy Hash: BC51A372618216ABDB25AEA4CC41FBBBBAAEB84750F354629FC04D7250EB35DC409790

Function 0096FA23 Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096FDB7: ResetEvent.KERNEL32(?,00721FD0,0096FA45,009A1E74,00721FD0,?,-00000001,0098F605,000000FF,?,0096FC7B,?,?,0096A5F0,?), ref: 0096FDD7
Part of subcall function 0096FDB7: ReleaseSemaphore.KERNEL32(?,?,00000000,?,-00000001,0098F605,000000FF,?,0096FC7B,?,?,0096A5F0,?), ref: 0096FDEB

ReleaseSemaphore.KERNEL32(?,00000020,00000000), ref: 0096FA57
CloseHandle.KERNEL32(00721FD4,00721FD4), ref: 0096FA71
DeleteCriticalSection.KERNEL32(00722170), ref: 0096FA8A
CloseHandle.KERNEL32(?), ref: 0096FA96
CloseHandle.KERNEL32(?), ref: 0096FAA2

Part of subcall function 0096FB19: WaitForSingleObject.KERNEL32(?,000000FF,0096FCF9,?,?,0096FD6E,?,?,?,?,?,0096FD58), ref: 0096FB1F
Part of subcall function 0096FB19: GetLastError.KERNEL32(?,?,0096FD6E,?,?,?,?,?,0096FD58), ref: 0096FB2B

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 3c70a53a22f36cd6d810e99d4d8313ca43d3fb12bce49b6989ab335042f1c743
Instruction ID: 732c1efe5fab289ddc33759459dabaff4685e96519fbeabd4ae2f91cab68922c
Opcode Fuzzy Hash: 3c70a53a22f36cd6d810e99d4d8313ca43d3fb12bce49b6989ab335042f1c743
Instruction Fuzzy Hash: 52017132144B44EFC7219F68ED59FC6BBEAFF86710F00452AF2AE92560DB716800DB61

Function 00979035 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096F35B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0096F376
Part of subcall function 0096F35B: LoadLibraryW.KERNEL32(?,?,?,?,00000800,?,0096DF18,Crypt32.dll,?,0096DF9C,?,0096DF7E,?,?,?,?), ref: 0096F398

OleInitialize.OLE32(00000000), ref: 0097904E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00979085
SHGetMalloc.SHELL32(009A20E8), ref: 0097908F

Strings

riched20.dll, xrefs: 0097903D

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: d61a6c9c050516c294bf59a2a84d853a1797abd026f677f22bcc805191fe19aa
Instruction ID: 4bbefe34943e59d8ecea427d62cc30153d2dc8710a19566c6e638704567790bb
Opcode Fuzzy Hash: d61a6c9c050516c294bf59a2a84d853a1797abd026f677f22bcc805191fe19aa
Instruction Fuzzy Hash: 0EF03CB1800109ABCB10AFADD8499AEFBBCEB84314F00415AE814A2210C7B45645CBA1

Function 0097991D Relevance: 6.0, APIs: 4, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0097992E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0097993F
TranslateMessage.USER32(?), ref: 00979949
DispatchMessageW.USER32(?), ref: 00979953

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: f5493d2ff6f875e37d1558f434ba5b60e0319f0cbd24cd97fe1df21ee82013dd
Instruction ID: 2e545da66d46550c58d23c82cb141ec81ef0562183dcff0104b583fef0200281
Opcode Fuzzy Hash: f5493d2ff6f875e37d1558f434ba5b60e0319f0cbd24cd97fe1df21ee82013dd
Instruction Fuzzy Hash: 20E0ED72C1612EA78B20ABEAAD4CDDB7F6CEE062657004016B519D2400D6689505D7F1

Function 0096FBBD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,Function_0000FD4F,?,00000000,00000000), ref: 0096FBE1
SetThreadPriority.KERNEL32(?,00000000), ref: 0096FC28

Part of subcall function 00966D8F: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00966DAD

Strings

CreateThread failed, xrefs: 0096FBED

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 5295d32be4a856495b5f3e8cc8f6336a0ae74c9a1016f5a0a8690545277758b5
Instruction ID: 86b0033aec91877dd5e408be629779cf75a21490ab81129e08dc57a51607e5b3
Opcode Fuzzy Hash: 5295d32be4a856495b5f3e8cc8f6336a0ae74c9a1016f5a0a8690545277758b5
Instruction Fuzzy Hash: 6701D6B63483096FD6246F6CBC66F66739DEBD1755F20043EF992961C0CAA16841C6A0

Function 00963A90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00963A95

Strings

CMT, xrefs: 00963AA4

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c0871c9c7892688cf2b7bfb5b20169b7e0cf8d664dd8348d0ec1ebd196402b8d
Instruction ID: adf78f6ec1ba37409d75349ac7aaddc596ee1b1e5b244e2d1fbc3c7f8898aede
Opcode Fuzzy Hash: c0871c9c7892688cf2b7bfb5b20169b7e0cf8d664dd8348d0ec1ebd196402b8d
Instruction Fuzzy Hash: 43619C71504F44AADB21DB34CC91AEBB7E8AF54301F44892EE5EB87242DB366A48CF51

Function 009882B4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 009882D9

Strings

, xrefs: 0098831E

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 89420b352763455b216a8a62aac443f271d7b85a8dd7ff2ae3ff006500e4f342
Instruction ID: 9d64b6b911734f3ea16b1c10d7c92a42c5ccd66dbfba403b4fb0d2372e1448e8
Opcode Fuzzy Hash: 89420b352763455b216a8a62aac443f271d7b85a8dd7ff2ae3ff006500e4f342
Instruction Fuzzy Hash: 28415A7150834C9BDB229E288C84BFBBBFDEB45704F5408EEE58A87242D6399945CF70

Function 0096192C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0096192C

Strings

CMT, xrefs: 009619A5

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c1505c19419cb4a6b3bc1dcdfdfce292d3a5e6bb89f1c973b4075596adaa6051
Instruction ID: 61998844630448b91790ef77fbc5a28e6da364a436990537e7007e31792935a9
Opcode Fuzzy Hash: c1505c19419cb4a6b3bc1dcdfdfce292d3a5e6bb89f1c973b4075596adaa6051
Instruction Fuzzy Hash: 2611E2B1A00245AFCB18DF65D4A1ABEFBFEFF85340F08441AE88697341DB359850DBA0

Function 009879FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,F5E85006,00000001,?,000000FF), ref: 00987A6B

Strings

LCMapStringEx, xrefs: 00987A0B, 00987A15

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: b5fc80cda1f6ea83e133fa35a1a5977b346fa2c2943e5a4fb2fedb407c808e07
Instruction ID: 457d4ccf4046c6a5c197e5bf40cea2ddc635aae8e07a9bad72ab4bfdac8c115b
Opcode Fuzzy Hash: b5fc80cda1f6ea83e133fa35a1a5977b346fa2c2943e5a4fb2fedb407c808e07
Instruction Fuzzy Hash: 76011376545209BBCF06AF94DC45EAE7FA2EF88750F108115FE1866260D636CA30EB80

Function 00987998 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0098708B), ref: 009879E3

Strings

InitializeCriticalSectionEx, xrefs: 009879B3

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 8a6ef54ec09e7f81e13d37640bb8328c1156dfb9ddb216587351bdd55038ea9c
Instruction ID: 0b804cec59104990ac8107bf5eacad147c8bc6ad4ab99867241d011449d911a5
Opcode Fuzzy Hash: 8a6ef54ec09e7f81e13d37640bb8328c1156dfb9ddb216587351bdd55038ea9c
Instruction Fuzzy Hash: 21F0E975A49208FBCF116F98DD45D9EBF65EF84720F108116FC1957260DA728E10E7C0

Function 0098783D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0098787C

Strings

FlsAlloc, xrefs: 00987858

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 8eb26e3aaa73af3e0faef72f53a17b5173ca99024a7f601178db86e832548ee1
Instruction ID: 49bcc4e83cad9bb2e36507839a96fed2564293354f5adb31f0c72f309788d404
Opcode Fuzzy Hash: 8eb26e3aaa73af3e0faef72f53a17b5173ca99024a7f601178db86e832548ee1
Instruction Fuzzy Hash: 07E0EC71B4A2147B8714BFA89C4596EBB98DBC4711F104056FD1557340D9754E00D7C5

Function 009613B4 Relevance: 3.1, APIs: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009613B4

Part of subcall function 00965F9E: __EH_prolog.LIBCMT ref: 00965FA3

Part of subcall function 0096C463: __EH_prolog.LIBCMT ref: 0096C468
Part of subcall function 0096C463: new.LIBCMT ref: 0096C4AB
Part of subcall function 0096C463: new.LIBCMT ref: 0096C4CF

new.LIBCMT ref: 0096142C

Part of subcall function 0096ACB6: __EH_prolog.LIBCMT ref: 0096ACBB

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 48657e2cd372c68e3e96ee64f6396c308ebda895f912f979108804e57f057098
Instruction ID: 853720e678e47823884f39841fe408354d55069e1d3366b669e2b195b738b0dc
Opcode Fuzzy Hash: 48657e2cd372c68e3e96ee64f6396c308ebda895f912f979108804e57f057098
Instruction Fuzzy Hash: 5F4125B0805B40DED720CF798485AE6FBE5FF28300F54492EE5EE87282CB326554CB15

Function 00969A62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,00967436,?,?,?), ref: 00969A7C
SetFileTime.KERNEL32(?,?,?,?), ref: 00969B2C

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 2f20e1865a27744d8f68c180c640c7e3531f8f6cf94cc371f27f1a51353e95f9
Instruction ID: 69ff7c53244c00e553ca2edc80abe79549bf228766a57212805acfa5a9707660
Opcode Fuzzy Hash: 2f20e1865a27744d8f68c180c640c7e3531f8f6cf94cc371f27f1a51353e95f9
Instruction Fuzzy Hash: 6721D331258245AFC710DFA8C891ABABBECAF96704F48091DB8D587141D339ED4CD791

Function 009698E7 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?), ref: 0096993B
GetLastError.KERNEL32 ref: 00969948

Part of subcall function 009696FA: __EH_prolog.LIBCMT ref: 009696FF

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: 6dcedcc89ae97722c7afb679f162067a57d170e83fc507a515987f99d832c7b7
Instruction ID: 0b30bb622b659ddc2a75ec752d5af2a21ca34fb10c2606c66c111db95a665ed7
Opcode Fuzzy Hash: 6dcedcc89ae97722c7afb679f162067a57d170e83fc507a515987f99d832c7b7
Instruction Fuzzy Hash: 6901D4322112069B8F188E1A9C44AAF776DFF92330704862DF92ACB290D730EC11E760

Function 00985ADA Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00985AFB

Part of subcall function 009859EC: RtlAllocateHeap.NTDLL(00000000,?,?,?,0098239A,?,0000015D,?,?,?,?,00982F19,000000FF,00000000,?,?), ref: 00985A1E

HeapReAlloc.KERNEL32(00000000,?,00200000,?,?,0099CBE8,009617D2,?,?,?,?,00000000,?,009613A9,?,?), ref: 00985B37

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 39662c302826197406e1ed8e29006229f78fe6b41d5c0d08d1bcfdc07728f6f8
Instruction ID: de471f73604231deeee377a9d442b0a20e7c721fb8d3c25a95f42ba6de1c0d31
Opcode Fuzzy Hash: 39662c302826197406e1ed8e29006229f78fe6b41d5c0d08d1bcfdc07728f6f8
Instruction Fuzzy Hash: 16F0F632351D15AADB313B26AC05F6B376C8FE1771B134116F818D6390EA74DD08D361

Function 0096A113 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,00000001,?,00969F49,?,?,?,00969DE2,?,00000001,00000000,?,?), ref: 0096A127
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00969F49,?,?,?,00969DE2,?,00000001,00000000,?,?), ref: 0096A158

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6c68d450e8eeb7677c706aa30e50fc81e1e1b39315af8cb5930e5701dcfb98e6
Instruction ID: 264b7003e786f4c360b22aa464105ce6dde2e2d7450d50073df43eb3fb2bba40
Opcode Fuzzy Hash: 6c68d450e8eeb7677c706aa30e50fc81e1e1b39315af8cb5930e5701dcfb98e6
Instruction Fuzzy Hash: 01F0A0312441096FDF115F64DC01BDA776DAF04381F048051B988D6060DB32CE99EB50

Function 0097C0CF Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0097C0FD
SetDlgItemTextW.USER32(00000065,?), ref: 0097C114

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 1479aedb03c7bd8f97c08a11feba4ea34ecc38912753ef61231358c694f285c4
Instruction ID: 89eabbae716ad9c359ab45d0c440ea1f1aa3cded2616be8ff17f034dceb66596
Opcode Fuzzy Hash: 1479aedb03c7bd8f97c08a11feba4ea34ecc38912753ef61231358c694f285c4
Instruction Fuzzy Hash: C5F0EC73954308B7EB21B7748C06F9A371DDB05741F04845AF609960A2D5715E20A7E1

Function 00978923 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00978944
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0097894B

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 570322568bc120a5ddde57ff4c31eed7295b8436fc2b903ecc43059fefb6cec5
Instruction ID: f926fe61f056c665d8a2672dd9df23fd185f6a6efe51c6a48e905421c2bbf326
Opcode Fuzzy Hash: 570322568bc120a5ddde57ff4c31eed7295b8436fc2b903ecc43059fefb6cec5
Instruction Fuzzy Hash: DCE0ED76901218EBCB60DF99C5057EABBF8EB08361F10C46EE84993641E6756E04AB92

Function 0097909D Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,0098F605,000000FF), ref: 009790C6
CoUninitialize.COMBASE(?,?,?,0098F605,000000FF), ref: 009790CB

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 75a8a90341007f074b50355d7b4c3e020dd2eda26d0106ffc1bd593b1c0725d4
Instruction ID: a5de930f5e0ee1023d525011df3882359b7bde1d7690cff4d368a929065dd8e2
Opcode Fuzzy Hash: 75a8a90341007f074b50355d7b4c3e020dd2eda26d0106ffc1bd593b1c0725d4
Instruction Fuzzy Hash: 5AE01272558654DFC311DB4CDD05B45B7E9FB49B20F104769F41993760DB346C00CB95

Function 009612C2 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 009612D7
ShowWindow.USER32(00000000), ref: 009612DE

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 02ea3fa75593d055f3ce1f9aabbcf42230ff1388764bfdb17da16148d96de110
Instruction ID: dac4d4fac232897f581d4cb21a2093d15c37331b7c4a0d0cb9698d2651b78cb7
Opcode Fuzzy Hash: 02ea3fa75593d055f3ce1f9aabbcf42230ff1388764bfdb17da16148d96de110
Instruction Fuzzy Hash: 0CC0123206C100BFCB010B74DC09C2EBBE9DB99211F00C905B4A5C0070C238C010EB52

Function 009619E2 Relevance: 1.8, APIs: 1, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009619E7

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bc96c98c3b6e6703c0ebe1312a32603334cb44b236731d83072e91c7bd29b525
Instruction ID: 289a1d80bb51f4bb5adb27b3c6670a6717c1df40f8124a623da9ee6bd3a245f6
Opcode Fuzzy Hash: bc96c98c3b6e6703c0ebe1312a32603334cb44b236731d83072e91c7bd29b525
Instruction Fuzzy Hash: 68B1E370A00646AFEB29CFB8C445BBDFBB9FF45304F1C425AE49693281C735A964CB91

Function 009681ED Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009681F2

Part of subcall function 009613AF: __EH_prolog.LIBCMT ref: 009613B4
Part of subcall function 009613AF: new.LIBCMT ref: 0096142C

Part of subcall function 009619E2: __EH_prolog.LIBCMT ref: 009619E7

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5201d9ed43e243b4a3e28a420b6548e8a1411f0ea256faebb40d1a9e563af933
Instruction ID: ebefb4ae773a01cda36da5b450bbc29387229ecd9a171bb416eee6264f46adc1
Opcode Fuzzy Hash: 5201d9ed43e243b4a3e28a420b6548e8a1411f0ea256faebb40d1a9e563af933
Instruction Fuzzy Hash: 8941A0729406589ADB24EB60C865FEA73ADAF90700F0405EAE48AA3192DF745FC8DB50

Function 009721E5 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009721EA

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ee43d497dc27b46f9dc1c8050342e86776a9c6bce82f1da2093b6f164566a67c
Instruction ID: 99bb4cfc6a1408d482a07c62b90d16daae6b568e0d3cd335c6f9be33731aef34
Opcode Fuzzy Hash: ee43d497dc27b46f9dc1c8050342e86776a9c6bce82f1da2093b6f164566a67c
Instruction Fuzzy Hash: E221E1B2E51215ABDB149FB88C41B6A77ACFF48314F00863AE51DEB682D7749D00C6A8

Function 00969120 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00969125

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fcff81c6c39c3413feb0635d034ef76a002a5c613a662f1147191cc4f87e3940
Instruction ID: ac46e4d9945e3ca5a546a88d1bccdcad6e05586604339391fb85fe56537c3e81
Opcode Fuzzy Hash: fcff81c6c39c3413feb0635d034ef76a002a5c613a662f1147191cc4f87e3940
Instruction Fuzzy Hash: A611A5B3E0452A9BCF22AF98CD91AEEB739FFC9740F154126F80577211CA348D1087A4

Function 00985A7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0098633C,00000001,00000364,?,00982203,?,?,0099CBE8), ref: 00985ABE

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7fb83fa31d108e158200fd180ef14bd3b887fa68c9126f213751f82b298c9d0f
Instruction ID: 6ae163d5eba7c54e8985d8e4c11fc22b7bd1120c6ad0c4cd3b0bd2415138431c
Opcode Fuzzy Hash: 7fb83fa31d108e158200fd180ef14bd3b887fa68c9126f213751f82b298c9d0f
Instruction Fuzzy Hash: 87F02431105A206BDB297B219CC5B2A374CAF81361F1B4211A82997380DA24DC0887E1

Function 009859EC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0098239A,?,0000015D,?,?,?,?,00982F19,000000FF,00000000,?,?), ref: 00985A1E

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c03369806170a600f091f2ea22d1e165aeff187b62312748ae6a70b9dfb74515
Instruction ID: 585a5215da3132955b57e3ebf8f0b734003d22c5403fc9e9d0b624fbd114dbbd
Opcode Fuzzy Hash: c03369806170a600f091f2ea22d1e165aeff187b62312748ae6a70b9dfb74515
Instruction Fuzzy Hash: C8E0E531165A219BE62437659DC579A364C9F813B1F030325AC1AD3390EB50CD08C7A1

Function 0096A195 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,?,?), ref: 0096A1C4

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: ccb8935a225c6d9e171918c830feba4dcd8ed058a1e3dd80592155c743ae0d75
Instruction ID: 98e46b3bbc9a136681c711580ff3cf93a1b51374c34006ddb0a81d437a9b5290
Opcode Fuzzy Hash: ccb8935a225c6d9e171918c830feba4dcd8ed058a1e3dd80592155c743ae0d75
Instruction Fuzzy Hash: 67F0823140C790EECA225BB48805BCBBB996F56331F048E4AF1FE621D2C27554D99B22

Function 0096F944 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0096F979

Memory Dump Source

Source File: 00000009.00000002.1557582306.0000000000961000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00960000, based on PE: true

Associated: 00000009.00000002.1556229385.0000000000960000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1558808220.0000000000990000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.000000000099E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1559355541.00000000009BA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000009.00000002.1560267667.00000000009BC000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_960000_zdfhrgzd.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 343549fd6937348839a4f08ac753315f70a522b775d26493f38f61cc4ad47cde
Instruction ID: 7ea61de54b93107d15b98282b57dfcbf8c9429605201c6bcda8fa1e9d1470981
Opcode Fuzzy Hash: 343549fd6937348839a4f08ac753315f70a522b775d26493f38f61cc4ad47cde
Instruction Fuzzy Hash: 01D02E42B1811067EA21332C3C2BBFD260A5FC2351F0C003AB049672C2CA850842E2A2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report T.T_Copy.12.18.2024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: ArrowRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1d5ba8cc-1a41-4e2c-af75-9cc14ef84ed6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF40c04b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fa0bb79a-5a8c-422a-9d07-2a6900c51088.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Windows Analysis Report
T.T_Copy.12.18.2024.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre