Edit tour

Windows Analysis Report
ModelsPreservation.exe

Overview

General Information

Sample name:	ModelsPreservation.exe
Analysis ID:	1587441
MD5:	bcae44d5bf6fcd34c12ef6a6502faf7c
SHA1:	7b383cb56e8070e1595da9d44885f2a9eb8037cf
SHA256:	f697d689701ccacd6870c3fc077cf6d12585dc6db60b3ab7db483e3d7180f966
Tags:	exeuser-zhuzhu0009
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Tries to resolve many domain names, but no domain seems valid

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ModelsPreservation.exe (PID: 5864 cmdline: "C:\Users\user\Desktop\ModelsPreservation.exe" MD5: BCAE44D5BF6FCD34C12EF6A6502FAF7C)

cmd.exe (PID: 3184 cmdline: "C:\Windows\System32\cmd.exe" /c move Sporting Sporting.cmd & Sporting.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2928 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1408 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6200 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6600 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4912 cmdline: cmd /c md 306780 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 2616 cmdline: findstr /V "wallpapers" Broken MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1992 cmdline: cmd /c copy /b ..\Nhs + ..\Opposed + ..\Mighty + ..\Pee + ..\Exact + ..\Cheese g MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Thus.com (PID: 6608 cmdline: Thus.com g MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 5232 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "brendon-sharjen.biz", "grannyejh.lat", "sustainskelet.lat", "rapeflowwj.lat", "energyaffai.lat", "aspecteirs.lat", "crosshuaht.lat", "discokeyus.lat"], "Build id": "HpOoIh--3fe7f419a360"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000B.00000003.2339909158.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000B.00000002.2363806123.0000000003C70000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000B.00000002.2363551998.0000000003B70000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000B.00000003.2339521170.0000000003F4D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.Thus.com.3f40000.1.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Sporting Sporting.cmd & Sporting.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3184, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 6600, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.871584+0100	2028371	3	Unknown Traffic	192.168.2.5	49795	104.102.49.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.180248+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.5	62490	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brendon-sharjen .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.112353+0100	2058039	1	Domain Observed Used for C2 Detected	192.168.2.5	50033	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.202115+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.5	57863	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.140424+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.5	56761	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.162592+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.5	56710	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.128921+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.5	62395	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.151646+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.5	54973	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.214695+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.5	50274	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:09.191190+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.5	64223	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:41:10.364434+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	49795	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://aspecteirs.lat:443/api	Avira URL Cloud: Label: malware
Source: https://rapeflowwj.lat/apipi	Avira URL Cloud: Label: malware
Source: https://crosshuaht.lat:443/apiH	Avira URL Cloud: Label: malware
Source: https://necklacebudi.lat/api	Avira URL Cloud: Label: malware
Source: https://crosshuaht.lat/apiH	Avira URL Cloud: Label: malware
Source: https://energyaffai.lat:443/apiu	Avira URL Cloud: Label: malware
Source: brendon-sharjen.biz	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "brendon-sharjen.biz", "grannyejh.lat", "sustainskelet.lat", "rapeflowwj.lat", "energyaffai.lat", "aspecteirs.lat", "crosshuaht.lat", "discokeyus.lat"], "Build id": "HpOoIh--3fe7f419a360"}

Multi AV Scanner detection for submitted file

Source: ModelsPreservation.exe	Virustotal: Detection: 66%			Perma Link
Source: ModelsPreservation.exe	ReversingLabs: Detection: 57%

Sample uses string decryption to hide its real strings

Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: brendon-sharjen.biz
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: brendon-sharjen.biz
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String decryptor: HpOoIh--3fe7f419a360

Source: ModelsPreservation.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49795 version: TLS 1.2

Source: ModelsPreservation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00C5DC54
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C6A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00C6A087
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C6A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00C6A1E2
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00C5E472
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C6A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00C6A570
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C666DC FindFirstFileW,FindNextFileW,FindClose,	11_2_00C666DC
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C2C622 FindFirstFileExW,	11_2_00C2C622
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C673D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_00C673D4
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C67333 FindFirstFileW,FindClose,	11_2_00C67333
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00C5D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306780	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306780\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.5:56761 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.5:56710 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058039 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brendon-sharjen .biz) : 192.168.2.5:50033 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.5:62490 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.5:50274 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.5:62395 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.5:64223 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.5:54973 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.5:57863 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:49795 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: brendon-sharjen.biz
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: discokeyus.lat

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: crosshuaht.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rapeflowwj.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: brendon-sharjen.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: energyaffai.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: necklacebudi.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uCnxmvEiQOcCxFeKjPHXFMBLCjf.uCnxmvEiQOcCxFeKjPHXFMBLCjf replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aspecteirs.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sustainskelet.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: discokeyus.lat replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: grannyejh.lat replaycode: Name error (3)

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49795 -> 104.102.49.254:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C6D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

11_2_00C6D889

Source: global traffic

Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=6871b4ece5a763eff56b3d4c; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type25665Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveFri, 10 Jan 2025 10:41:10 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: uCnxmvEiQOcCxFeKjPHXFMBLCjf.uCnxmvEiQOcCxFeKjPHXFMBLCjf
Source: global traffic	DNS traffic detected: DNS query: brendon-sharjen.biz
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ModelsPreservation.exe, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: ModelsPreservation.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: ModelsPreservation.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ModelsPreservation.exe, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ModelsPreservation.exe, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: ModelsPreservation.exe	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: ModelsPreservation.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ModelsPreservation.exe, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: ModelsPreservation.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: ModelsPreservation.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: ModelsPreservation.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: ModelsPreservation.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ModelsPreservation.exe, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: ModelsPreservation.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: ModelsPreservation.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, ModelsPreservation.exe, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: ModelsPreservation.exe	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Thus.com, 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmp, Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Apartments.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat:443/api
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=aep8
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshuaht.lat/apiH
Source: Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosshuaht.lat:443/apiH
Source: Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api
Source: Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://energyaffai.lat:443/apiu
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/api
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rapeflowwj.lat/apipi
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Thus.com, 0000000B.00000002.2363191959.000000000150A000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900u
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/7656119972433190012%121%41%41%41%41%76%120%123%123%126%121%1
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Spring.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443

Source: unknown

HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49795 version: TLS 1.2

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C6F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

11_2_00C6F7C7

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C6F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00C6F55C

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C89FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

11_2_00C89FD2

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C64763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

11_2_00C64763

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C51B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00C51B4D

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		11_2_00C5F20D

Source: C:\Users\user\Desktop\ModelsPreservation.exe	File created: C:\Windows\EditorNationally	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	File created: C:\Windows\AbandonedRocky	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	File created: C:\Windows\ChamberClassification	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	File created: C:\Windows\ExpensePlace	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	File created: C:\Windows\InterestOpening	Jump to behavior

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C18017	11_2_00C18017
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00BFE1F0	11_2_00BFE1F0
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C0E144	11_2_00C0E144
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00BF22AD	11_2_00BF22AD
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C122A2	11_2_00C122A2
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C2A26E	11_2_00C2A26E
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C0C624	11_2_00C0C624
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C7C8A4	11_2_00C7C8A4
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C2E87F	11_2_00C2E87F
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C26ADE	11_2_00C26ADE
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C62A05	11_2_00C62A05
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C58BFF	11_2_00C58BFF
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C0CD7A	11_2_00C0CD7A
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C1CE10	11_2_00C1CE10
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C27159	11_2_00C27159
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00BF9240	11_2_00BF9240
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C85311	11_2_00C85311
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00BF96E0	11_2_00BF96E0
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C11704	11_2_00C11704
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C11A76	11_2_00C11A76
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C17B8B	11_2_00C17B8B
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00BF9B60	11_2_00BF9B60
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C17DBA	11_2_00C17DBA
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C11D20	11_2_00C11D20
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C11FE7	11_2_00C11FE7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\306780\Thus.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: String function: 00C0FD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: String function: 00C10DA0 appears 46 times
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: String function: 004062CF appears 58 times

Source: ModelsPreservation.exe

Static PE information: invalid certificate

Source: ModelsPreservation.exe, 00000000.00000003.2094077541.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs ModelsPreservation.exe
Source: ModelsPreservation.exe, 00000000.00000002.2095016060.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs ModelsPreservation.exe

Source: ModelsPreservation.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@22/20@11/1

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C641FA GetLastError,FormatMessageW,

11_2_00C641FA

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C52010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		11_2_00C52010
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C51A0B AdjustTokenPrivileges,CloseHandle,		11_2_00C51A0B

Source: C:\Users\user\Desktop\ModelsPreservation.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C5DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_00C5DD87

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C63A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

11_2_00C63A0E

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6132:120:WilError_03

Source: C:\Users\user\Desktop\ModelsPreservation.exe

File created: C:\Users\user\AppData\Local\Temp\nstBD27.tmp

Jump to behavior

Source: ModelsPreservation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\ModelsPreservation.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ModelsPreservation.exe	Virustotal: Detection: 66%
Source: ModelsPreservation.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\ModelsPreservation.exe

File read: C:\Users\user\Desktop\ModelsPreservation.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ModelsPreservation.exe "C:\Users\user\Desktop\ModelsPreservation.exe"
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Sporting Sporting.cmd & Sporting.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 306780
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wallpapers" Broken
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nhs + ..\Opposed + ..\Mighty + ..\Pee + ..\Exact + ..\Cheese g
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\306780\Thus.com Thus.com g
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Sporting Sporting.cmd & Sporting.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 306780	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wallpapers" Broken	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nhs + ..\Opposed + ..\Mighty + ..\Pee + ..\Exact + ..\Cheese g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\306780\Thus.com Thus.com g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: ModelsPreservation.exe

Static file information: File size 1405721 > 1048576

Source: ModelsPreservation.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: ModelsPreservation.exe

Static PE information: real checksum: 0x15a736 should be: 0x16361c

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C10DE6 push ecx; ret

11_2_00C10DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C826DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		11_2_00C826DD
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C0FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		11_2_00C0FC7C

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_11-103474

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

API coverage: 3.7 %

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com TID: 7104

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\ModelsPreservation.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00C5DC54
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C6A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00C6A087
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C6A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00C6A1E2
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00C5E472
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C6A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	11_2_00C6A570
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C666DC FindFirstFileW,FindNextFileW,FindClose,	11_2_00C666DC
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C2C622 FindFirstFileExW,	11_2_00C2C622
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C673D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	11_2_00C673D4
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C67333 FindFirstFileW,FindClose,	11_2_00C67333
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C5D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00C5D921

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00BF5FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_00BF5FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306780	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\306780\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: Thus.com, 0000000B.00000002.2363191959.000000000152D000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Thus.com, 0000000B.00000002.2363191959.000000000152D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C6F4FF BlockInput,

11_2_00C6F4FF

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00BF338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00BF338B

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C15058 mov eax, dword ptr fs:[00000030h]

11_2_00C15058

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C520AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

11_2_00C520AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C22992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00C22992
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C10BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00C10BAF
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C10D45 SetUnhandledExceptionFilter,	11_2_00C10D45
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C10F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00C10F91

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: Thus.com, 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

11_2_00C51B4D

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00BF338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00BF338B

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C5BBED SendInput,keybd_event,

11_2_00C5BBED

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C5ECD0 mouse_event,

11_2_00C5ECD0

Source: C:\Users\user\Desktop\ModelsPreservation.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Sporting Sporting.cmd & Sporting.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 306780	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wallpapers" Broken	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nhs + ..\Opposed + ..\Mighty + ..\Pee + ..\Exact + ..\Cheese g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\306780\Thus.com Thus.com g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C514AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

11_2_00C514AE

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C51FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00C51FB0

Source: Thus.com, 0000000B.00000000.2127124535.0000000000CB3000.00000002.00000001.01000000.00000008.sdmp, Thus.com, 0000000B.00000003.2345606155.0000000004063000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Apartments.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Thus.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C10A08 cpuid

11_2_00C10A08

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C4E5F4 GetLocalTime,

11_2_00C4E5F4

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C4E652 GetUserNameW,

11_2_00C4E652

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com

Code function: 11_2_00C2BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

11_2_00C2BCD2

Source: C:\Users\user\Desktop\ModelsPreservation.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 11.2.Thus.com.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2339909158.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2363806123.0000000003C70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2363551998.0000000003B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2339521170.0000000003F4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: Thus.com	Binary or memory string: WIN_81
Source: Thus.com	Binary or memory string: WIN_XP
Source: Apartments.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Thus.com	Binary or memory string: WIN_XPe
Source: Thus.com	Binary or memory string: WIN_VISTA
Source: Thus.com	Binary or memory string: WIN_7
Source: Thus.com	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 11.2.Thus.com.3f40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2339909158.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2363806123.0000000003C70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2363551998.0000000003B70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2339521170.0000000003F4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C72263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		11_2_00C72263
Source: C:\Users\user\AppData\Local\Temp\306780\Thus.com	Code function: 11_2_00C71C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		11_2_00C71C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	16 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 Masquerading	LSA Secrets	121 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ModelsPreservation.exe	66%	Virustotal		Browse
ModelsPreservation.exe	58%	ReversingLabs	Win32.Trojan.Lumma

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\306780\Thus.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://aspecteirs.lat:443/api	100%	Avira URL Cloud	malware
https://rapeflowwj.lat/apipi	100%	Avira URL Cloud	malware
https://crosshuaht.lat:443/apiH	100%	Avira URL Cloud	malware
https://necklacebudi.lat/api	100%	Avira URL Cloud	malware
https://crosshuaht.lat/apiH	100%	Avira URL Cloud	malware
https://energyaffai.lat:443/apiu	100%	Avira URL Cloud	malware
brendon-sharjen.biz	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
sustainskelet.lat	unknown	unknown	false	high
uCnxmvEiQOcCxFeKjPHXFMBLCjf.uCnxmvEiQOcCxFeKjPHXFMBLCjf	unknown	unknown	true	unknown
crosshuaht.lat	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
aspecteirs.lat	unknown	unknown	false	high
discokeyus.lat	unknown	unknown	false	high
energyaffai.lat	unknown	unknown	false	high
necklacebudi.lat	unknown	unknown	false	high
brendon-sharjen.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
necklacebudi.lat	false		high
aspecteirs.lat	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
rapeflowwj.lat	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
energyaffai.lat	false		high
brendon-sharjen.biz	true	Avira URL Cloud: malware	unknown
grannyejh.lat	false		high
discokeyus.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crosshuaht.lat:443/apiH	Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discokeyus.lat/api	Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Spring.0.dr	false		high
https://recaptcha.net/recaptcha/;	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://necklacebudi.lat/api	Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=aep8	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://medal.tv	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crosshuaht.lat/apiH	Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://s.ytimg.com;	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/7656119972433190012%121%41%41%41%41%76%120%123%123%126%121%1	Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=engli	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steam.tv/	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900u	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Thus.com, 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmp, Thus.com, 0000000B.00000003.2345606155.0000000004071000.00000004.00000800.00020000.00000000.sdmp, Thus.com.2.dr, Apartments.0.dr	false		high
https://store.steampowered.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	ModelsPreservation.exe	false		high
https://steamcommunity.com	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sketchfab.com	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aspecteirs.lat:443/api	Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://rapeflowwj.lat/apipi	Thus.com, 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://energyaffai.lat:443/apiu	Thus.com, 0000000B.00000002.2363003557.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363191959.00000000014EA000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	Thus.com, 0000000B.00000002.2363191959.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	Thus.com, 0000000B.00000002.2363551998.0000000003BC3000.00000004.00000800.00020000.00000000.sdmp, Thus.com, 0000000B.00000002.2363551998.0000000003BF9000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587441
Start date and time:	2025-01-10 11:39:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ModelsPreservation.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@22/20@11/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 76 Number of non-executed functions: 299
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:40:42	API Interceptor	1x Sleep call for process: ModelsPreservation.exe modified
05:41:08	API Interceptor	2x Sleep call for process: Thus.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=AE2AE4DBF33A541E83BC08989DB1F397&steamid=76561198400860497
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	filename.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	expt64.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SensorExpo.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	anti-malware-setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	cache_registerer.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	Invoice.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	NvOxePa.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	h3VYJaQqI9.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	filename.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	expt64.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SensorExpo.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	anti-malware-setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	cache_registerer.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	armv5l.elf	Get hash	malicious	Unknown	Browse	23.209.153.127
	http://postman.com/	Get hash	malicious	Unknown	Browse	104.102.43.106
	https://sanctionssearch.ofac.treas.gov	Get hash	malicious	Unknown	Browse	23.49.251.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	filename.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	expt64.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	1.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SensorExpo.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	anti-malware-setup.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	cache_registerer.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	104.102.49.254
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.102.49.254
	Invoice.exe	Get hash	malicious	LummaC	Browse	104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\306780\Thus.com	SensorExpo.exe	Get hash	malicious	LummaC	Browse
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	[UPD]Intel_Unit.2.1.exe	Get hash	malicious	LummaC	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	RailProvides_nopump.exe	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	installer_1.05_36.8.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\306780\Thus.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SensorExpo.exe, Detection: malicious, Browse Filename: appFile.exe, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: [UPD]Intel_Unit.2.1.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: RailProvides_nopump.exe, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: installer_1.05_36.8.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\306780\g

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	459777
Entropy (8bit):	7.999545303906971
Encrypted:	true
SSDEEP:	12288:2y+v55VbyJg2SW/05vIP6fsIW8JDywdj9FMCR:J+v5nGJg2l/0lrkIr/j9FB
MD5:	A60D9DB58E543EC3C28B130D0E34308F
SHA1:	B29A076831AF6AA97B78AAC211CC02EAD3C08C5E
SHA-256:	8FD5F42B71FAC0FD4DCE26DD66F12D866AD57449DEC6630BC7AAC9E86D32B138
SHA-512:	1299907F67FAD3E275AFA5352AAEC5775594CE180D48BF4C96227A85E9C3E0515A6039DCAF14D81BD0DA0AE661D863B56178EE3CF0A1E78ABCBFDD4ACF052B31
Malicious:	false
Preview:	@..c..=w1.+n...WS....;&.pq.T8.....F.....[.H:.[.2.?..r.TS..".y[.b...8z3.c+..'6w..W.Y.8L...&......)[...C../G.;+\0)_!I{..v..p..h....A..S.].L....,..[t..O..n.R....CA.O..S.z/..p.h....M..V..7l..\|L:.R.u.....<t+.s.....8./...i.....M.-.".67Fn...>.X...d.I.v..J.DP.=.g1U.....e.$W..S..!..}'._.hE.2....O..mq..I.7W......3/.-.?-.0.M.~s.u..gF...G.....R.I...m:B.w@.=B5.Z$a..=...gKO.0...`5.5.P.$g4^....,R.7 ...+6...._G..A...$p.GgI.4..#-.`.5k)...J.1.....-0&.^...n."7.1.Io.v.%..6@....A#..^9..&...'Xa.5lE.+...W_ (k.w[....0X..6....._.i.....fq....S>.4eFC...\..s..r...S..d...W8Q6..eq.`^Y.=...+..Y.t..ZQ<...z.Am.&......5g..>..b.(T.....-.4%....U}......s>.AD.C.D.R@.......f.Y.. ..\|..v..v@.k.....t.F?....Wo..(!)..eL..Fz.....u......N....>.&.B...)7.......#...5.+GP..Lr..k?T.[.& LI.O1=./...U\..:.fn.....1........`x..n.-...r.'d.D..#=_7e..(d:(....r...\.R.Q.$.".f.ET.]XF)...FF.p..H...'W..\.<A...Y.q.vm+e.R`.....\|......F..8..,..H..j.(.o`....o-....m..t..q.x.&M..RR....Q"pJ.G............?h....

C:\Users\user\AppData\Local\Temp\Adam

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.583126462536611
Encrypted:	false
SSDEEP:	768:uUzSLKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/mex/Sc:Pz08QuklMBNIimuzaAwusPf
MD5:	86FBE2F2CA2062A4D20C0B1FD379F884
SHA1:	62CC1EB1CA9A881605E9B2A7A696E063DFA1CFD8
SHA-256:	C65A8DF4F832013787E2123C5707EBE7ED962BBA704C443AD991386F2FCA0D28
SHA-512:	908CDFCB7CBDD0421957C08E28A73B2F0078FEF6C706D2DA49C3E81D61E11B0B838BCB6444035511D953AA81BC85438CA510004CA08417F23378822BCFCFD377
Malicious:	false
Preview:	.>............9.6........k.<..xE.........CqTR;............dG.... ......G..gL....@...._h..%.?............SS.@....................b...?.Wd...y>c..GP...AiFC.........?........53..=..?...)a.<a.w>.,.?].[S..q...n..C.?n.w.....t...Y.?e.u..s.<...)kp.?&<......u.E..?...K..a<....>..?5a1.xH.<...lX..?.a.J...<.Gr+...?qO.....<...2...?R{.'.:@<....f..?{.N..k.Q[.....?9.D9....1l...?.l...Q..-...B.?.6./..Q...Z.?...j@.<{Q}<.r.?u..A....8...?k...#...u.o.[..?.hI{L[.<.\....?...5.S....h1...?<d..n..<..."P..?..{.....b.;..?..J.u.<..}.I..?..~..<8bunz8.?r..~..<?..O.Q.?....U..<.\|.eEk.?..@.3..<.c....?}.?.:L.........?U......<.......?..8...A......?.A.TG..<V/>....?.#.E..q<..1....?.1.j.<1.L.p!.?\|....<..d..<.?.Y6.!'.<._.V.?(FN\.\...:7.q.?..B..:..f..m...?...<.......4..?..a.6.u....-..?.)]7...."4.L...?......<....E..?..V.#....!...?x.0.i.^...P..1.?.y_....-.a`.N.?...z.H<W...Aj.?v.d.K..<.<.....?.b....s<......?V...b.<'*6...?.B.C}<.......?3xj...<.,.v...?.WY.....Bf....?.i.v...O.V+

C:\Users\user\AppData\Local\Temp\Apartments

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	5.751959010667038
Encrypted:	false
SSDEEP:	1536:VKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9BGmdATGODv7xvTphAiW:J6whxjgarB/5elDWy4ZNoGmROL7F1Gb
MD5:	8BDAB09194BCF5D66620DD1A9FACF894
SHA1:	62A3113668523BFA38697B7A9C7C3F1059636DA2
SHA-256:	2FAFF363E0710D0161C0C12BE67745077CA3E7217828B44B638C84550E3039B3
SHA-512:	BCD38580BB353C47BAEAC34CA46B04FF269540A910CE1B88FE05FBFA42F8C7ACCC098EB9C19CF1AC8408AF8C9691296185B88AFB631DB4B66B08B43F700ED3FA
Malicious:	false
Preview:	...................................................................................................................m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.................................(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.r.r................................. !"#$%&'()))*+,-./0123456789:;<=>?@ABBCDEFGHIGJKLLBMBBNOPQRSTUVWXYZ[\]^G_____________

C:\Users\user\AppData\Local\Temp\Broken

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	4.319251410877129
Encrypted:	false
SSDEEP:	24:ZyGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/4:S9n9mTsCNvEQH5O5U1B
MD5:	8ECCC8F820616CE78209B17CD49DCAE2
SHA1:	B3A50BAEE8BB942E58541D08F0B46F8D970EE211
SHA-256:	228304A12F8D53A4412189E7DAEB36E91152A559DD5771F8E759671613A72CDE
SHA-512:	94F807098DE485976D84E0F2ED910F1DC5A00E0F237E573B68E8C5B3A83F34375E9B221AA9C91AE363FD8E825BA95676ED2E82D17881C71B7079C568DECC36BB
Malicious:	false
Preview:	wallpapers........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B......................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cashiers

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	111616
Entropy (8bit):	6.644440214801263
Encrypted:	false
SSDEEP:	3072:d0Imbi80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrH5:kbfSCOMVIPPL/sZ7HS3zF
MD5:	626544DB47DEB510641FF5765D07C448
SHA1:	79D0E2DB7C3CC534B79BC04200C0A08E5E21B8A7
SHA-256:	F3AD3199AC7C32BBBC38F24AA0AD7B5B3E44FAF78F07D252C8A82225C0C3E9EB
SHA-512:	2CC3F6689CA0ADA299E59D560C54E677BF85380D48CF99FAF5AC3F564780E3FA10D12CC0968CC45A8820C2E3F8CECD6BE07CF90E8B02162FD3D5670649F72087
Malicious:	false
Preview:	...........u.3.........,...P.......r........z.....,......m.....,...3......3......0........0......F..;.....u.....5.....,.....s.........0.....,..........,....w\|..0........P........,...P..0...SP...........=..............,............,...3......3......0........0......F..;.....u..R...;.,......................0.................u...,...........t...,.........3.3.....................+...\|.....................u%;.......!.......V..............0....3.3........9.............stW;.u.........@................................................@A..............;.....u...t4..s......;.u..........A.........3................A...s........\|.........F;..........,......P......P..0...SP.......................+...................................!J..........................,...........3.3....0.......0............F..;.u...t...,.....ssN...0.....,....e3.P........,.........P..0...SP........2..7............,....j...3.P..,...............P..0...SP.................,...........tw3.3....0...j.Z......0......G..;.u.

C:\Users\user\AppData\Local\Temp\Cheese

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	73729
Entropy (8bit):	7.997675894503253
Encrypted:	true
SSDEEP:	1536:b8yAdw5c6dT/O1Ng/H25vgFBHvg1cKNYHRswBd:rAdw5jdjOLgH2OfvgKKNYHRs0d
MD5:	71291CDB1457619C224B2BDF8F947EA0
SHA1:	991208F16A6A57DB3E7CBEA6C0303EC8E44974B1
SHA-256:	20BD748FB58EA8AB9777DADB1A7BB337574FAB69D6FD3856A04A0D423788D950
SHA-512:	59913C6D3709B6EAAD3A218F9BFA5D36A9064056985F118A4CCD71E20E3571DCAB584692242CDBBB24E2BFF698387CBFF064201D4AFA67DC0619D7B049898F7C
Malicious:	false
Preview:	.....=>...8...........m.h......,j@.P..w...i...s.F....=`{H./............4.'!....[mY.i}..)M.l..+..4..J.;.D.:;.E..I...D.viW6.m9.?,6<o')R.{.;Ka..y..........jrp.F.T.<..0S....iT...2b.V..}SO.....g.(.........[.{....[...s.g..\=.C...YO4.n..a+$_.m.,P.. \.p.S...,B..\.....;.c..5..m...xrM...+Y..`g.y....V.[........d.X.RNT,L.mA.g....t......l...\$...`..Xae.^..Ky.P.I6...y`....Hy..>,q...{...Dq.....t.@..'6q=.`...=...j&.n......^.....z.z.t99...av...$...f0.M...V...H.t../.\C.F<..8.bd..O...q..k..v+..9....p.k..C.f.....'U.8#....7........M........^yA..{..ol...!.o...6......r....a......3..vk.-.2.O...[....z..!..#..&.L.H.(.Tp..g.(:Y...........k.v.^........1.Cf}7G........%.v....].....g,-[T...).=?I...OL.u.F....M+.6.c. .$.[#h..`$.......2...U..)...i..5d..?.io.&Mp...XJ..Z......<.gX.^..P..grt..BX.:......N6j!..b.]j..C..../.S..#.5.+.3........2.......b...I......BaM....r...,..b.........vQ..pc0..7.M.Q+-..S..c..&w....y...!.=.)..>..,...Y..u.....^m.)z6+;..cz./...uD6.U..th.

C:\Users\user\AppData\Local\Temp\Exact

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	7.997781567762096
Encrypted:	true
SSDEEP:	1536:UvGam8KE7ngcxCqvLUlMZNxCCX27VyKQCUTFz5VPj:UvGam8d76u70QBTFzrj
MD5:	82C5AB2BAF653DDC124963FF8703E05B
SHA1:	20CD128C297382976BD4E471F5136A92A32EAE84
SHA-256:	A212CB65191970F32C7F94F2ED7B63FDC2CB71C59DD89AB68462156EB99C266C
SHA-512:	E723CD3CEEEF6304D362C2FBE69554F9FCDB94D867055B70503AD3F9F3B85933FD2310E23CEAE1779704D1A8BE3B6404588BF9B38EF65A3ACDD651725821DF53
Malicious:	false
Preview:	..7...K......R/...A.P....D....4......'......G..g,/~.T'..e..r0R.%....;w.N?..c......K.....-..._.9..6...U...........E.\|.EA../}...e.\|.L.....Pu.....]....^/.. ..^..$<%UC....!....JD...i...}.t.@.&.U..:...(..M'..9.....Tb..~I`.,..n.G.....{..j.. ..2....Oa..UT...F.A.,S..}..nx..-.cU.B.../..xxC4.?......:..........@.Q.5q.}...\|....J.....=.D..A.l.;.VYU#Y.j..O\|.....(j....dbS.[l.....H..RM@..b...enZyP.{3...V..i...)..:.W.C<,..-.q.i..BD...?..}cCmwT.[S.d...........t...mS.].:...Wne....n'x\|.f..q.aL......'...L.>.8J.nw..P...:.....H...OEj]S.....=......\|....:4.]..82./..7.sr.<.;^.........^...,.\|.W...7F.6....T..kb....~"0#......p..o.`...~x.......C..A."........^.iD..<.t.=.L..g..[.L....`.G.g..<...J.p.=.'.{..CO...8....ysv9./..../...m..O._% J.;....au....i(gy..,C.S.,.3.......\..BJ.......G.2..O.A.M}...k...1..].C.E....B&...yw.....7.....p..?.-8..^.j..+Tx../--;..Y.6{N..9.v~.......7.....3%_.7..<F....`..'.....ii.>..BZ....Y.A...A ..uvCx..l......R..6.a.)....{}.S.

C:\Users\user\AppData\Local\Temp\Expert

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	145408
Entropy (8bit):	6.668766912525161
Encrypted:	false
SSDEEP:	3072:4BRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+Ag:SNPj0nEo3tb2j6AUkB0CThp6vM
MD5:	41BEC8B99D97B29AB8486DBD90B8C18D
SHA1:	DB062DD94C07AAF03828A22A7AE37B8D3D5A283B
SHA-256:	5AB707F4A01A1425155D60220C81C4C6B9BF192C6FD00666F8250C4D374C489D
SHA-512:	9C253CA61A60A3367929A34E4F972CED06E7264A1054E355CE3EFBFB5349B04881A91D3239850BABFC041C487A7CF460FE8B142528CAA64A9E3D27C80A6E311E
Malicious:	false
Preview:	.......}..-...E..j.X....M.....&..3...E...+.......#...]..E.SP.N..U..'.....3.YY.u.9...."...E..M...+..............](..f;.w0.{...j.[......U..8t.........f;.h...v..](.....j#Xf;.......j.X....>f..t........K...t';.sM.u.......WQ...........t4...4V.q............+.;.w.f;.....u.;U.t.f.F.f;.....t.j.Y..}..t.f.......f#.....f;.u.....>f....t...........3.u...+..f9V....+..f9F....+......u....f....S......j)Xf;.t..r..u........f..u.f9...,...j?Z.....E.E...............j.^VR.B.P......U.F}.}........},..}.f..jxXf.r.f.B.f.r..t.......u?.E(j.Y.P .@...;.r.E(.M...r.j.+H.X....;.u..F.f.B..u..U..r...U.u..g..jnXf;.......joXf;.......jpXf;.......jqXf;.........r......jsXf;.........t......j..A.[f;........E.+..E...3....E.E......].f;.u....f9B...........f;.M.s.........E...x....~..E.E....E..........u..r..U..u(;.E..u.f...G.}............PWV.}.....j.X.E..}..u......f........E.......}.f...u..P.M.j.Z.V.........W.}.W.G.P._}...E....E..............f....j.f..Z..3....M.E.f...U..u.J.?....E.;...+....},.tJ.A.3.

C:\Users\user\AppData\Local\Temp\Lie

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	6.261318355510714
Encrypted:	false
SSDEEP:	3072:YZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3lag:YK5vPeDkjGgQaE/lF
MD5:	5117FF8A6F809D8F8022230A76BF51D8
SHA1:	F8D427A45D409E9A221DFA1836336DAB89AA4B70
SHA-256:	96DD8C9F9A3A47C26EBC7ED191CCE55B2D819BD1110D2B20C0F99F97E2F9D758
SHA-512:	C709BF9DCC5618E092A4EB01E8B3584B09E67CD5979EA6F45465FF10FB3F956ABB9C71CFE640C91DCCC13D7F7AEBA192AF79D7A00D6C6F76DD8D4A8887964B3C
Malicious:	false
Preview:	.......p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M.

C:\Users\user\AppData\Local\Temp\Mighty

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	7.997033926294743
Encrypted:	true
SSDEEP:	1536:1xMkPtjoRv//utwY5y8UoiVzUSM/vCfdI7E/j7KBrwwYPkkvfY:1x3PtjoNMN5y5JVIS66fLHKBWr4
MD5:	F82466887A60C7EBBC36D971845DE219
SHA1:	12BDA8E847C18F3F3E2DBD952078BD76E5C59118
SHA-256:	EB30343FCDCE51976E366BBB34ECE5D23BC41379304B061240FCA88453C73AB1
SHA-512:	91814002DCFAEBB129CD5FF669C95FA1B5A66E6F1DDB741F31D6E14A364D0F70727426267450D66811EAB977D086B743E05F6392DC49261EBB4E845347CFB993
Malicious:	false
Preview:	&.b.i6..].;....`.d......U.@..R;..T.X..gQ?Y...W.0...L..6..p.f.gw.....k...,..m....0...J...Fv.'.....x..b..Wp............v.+.......YQ....9.....\|b.G...Fwe.e.n..quW.....O.....s6...p..5..I....HN.^s.q;..f]q.[`.C.i.....m.%.....-.o.XG...\|t.&bIcm.)l.V.b.2y.....{.s.......Z.&1.....G.Ht.I..y....8.qP....kb.4..9.N\..r.....p?....D..$.8,# 78....r...A.........E.....&T.\.5........c.!.P......[i.z...k.._...1.+~exK...]..'.U.&V..>....y&\..$......&...?3\8Ouc..k.n.h....#..j..f.YyA...T.v"...G.P.;D.&.+.Q^F.tE>.s.%>......]...(.u...n.....3.\|.Hpc_.%.K..AN]\_D.SV.J.k9.4..."[*.3...........-.......T..O.....AZ}7...3:c....kE....U.opN............ gT.5~.W.(.5.\|dY.....B........).$._LPBO..:..9..I...u_..;O../....a!.f.._o.T.Ct..a.D.B9.Kz...MF...\|....N{4./...\|..:.9"..slz.z..1c;..4......+../KZ...o...\|.u.v......q..j...f..S.Q.<.....,60"r...-.p.\=..3,.d.......a..pw.z....}..A..;...$.........1......B..-%.M..2..s.plxg.5.7~.<.[..SI..}....&...).Y....6<...A.1K.v.....

C:\Users\user\AppData\Local\Temp\Nhs

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.99797649007832
Encrypted:	true
SSDEEP:	1536:C5wfnky6BGusrOrizWp1klWBHY4W5cS0pWeJdYAG0w+lrUqrGGBHLgRbbn7EefgM:Ay6B3s+vn1Yf5Cp7cAG0hr/r2b7Egff
MD5:	99A70B64293C43CDC840AF3C54583F47
SHA1:	3B95BC8D825FFBB3C07721CF0F50275ED5ABDAB1
SHA-256:	79A7DA521EA3F175A40553D569A3318D80D358DA388866F710A8D6DEBEAAEC0F
SHA-512:	BB7E70271F57114CDAD66F4F2435E0F4C65CB0E20F3B2E864A78F1D6A34B571FD142DC70E899A51797EA1321E1565B3CFB726440A7434DE9CA156215BF616989
Malicious:	false
Preview:	@..c..=w1.+n...WS....;&.pq.T8.....F.....[.H:.[.2.?..r.TS..".y[.b...8z3.c+..'6w..W.Y.8L...&......)[...C../G.;+\0)_!I{..v..p..h....A..S.].L....,..[t..O..n.R....CA.O..S.z/..p.h....M..V..7l..\|L:.R.u.....<t+.s.....8./...i.....M.-.".67Fn...>.X...d.I.v..J.DP.=.g1U.....e.$W..S..!..}'._.hE.2....O..mq..I.7W......3/.-.?-.0.M.~s.u..gF...G.....R.I...m:B.w@.=B5.Z$a..=...gKO.0...`5.5.P.$g4^....,R.7 ...+6...._G..A...$p.GgI.4..#-.`.5k)...J.1.....-0&.^...n."7.1.Io.v.%..6@....A#..^9..&...'Xa.5lE.+...W_ (k.w[....0X..6....._.i.....fq....S>.4eFC...\..s..r...S..d...W8Q6..eq.`^Y.=...+..Y.t..ZQ<...z.Am.&......5g..>..b.(T.....-.4%....U}......s>.AD.C.D.R@.......f.Y.. ..\|..v..v@.k.....t.F?....Wo..(!)..eL..Fz.....u......N....>.&.B...)7.......#...5.+GP..Lr..k?T.[.& LI.O1=./...U\..:.fn.....1........`x..n.-...r.'d.D..#=_7e..(d:(....r...\.R.Q.$.".f.ET.]XF)...FF.p..H...'W..\.<A...Y.q.vm+e.R`.....\|......F..8..,..H..j.(.o`....o-....m..t..q.x.&M..RR....Q"pJ.G............?h....

C:\Users\user\AppData\Local\Temp\Opposed

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.99769598839902
Encrypted:	true
SSDEEP:	1536:rf4NqJJ84i9GpEwkgaSM5xgRgHKsE4nCrowi17+T7TNEeBzBoWIwttVX:rkq84f+wVNM+6KsEwCrk7q7pEBwtj
MD5:	7F30991FCC979B0C2880CA2B1CC7AC86
SHA1:	F2F7272C202C43F3EA50C7DF06C860D9408D0969
SHA-256:	77EF860123E7C9F530D64724820EDF34C19A3D3E705F5061A8691B03C12EC120
SHA-512:	8369A8A5C45E6963B2FF0AFAFFE597A17191326EA5EA37E0BA1F24148A909AC769023B2BC9EECD09C6304B339D9DC63AACC07F4F48D16276AE8A3D776C5D6FFD
Malicious:	false
Preview:	~l..&.33w.....r-..)w....f..V.W..u.H..<w 2...4A..%%o...A.E;...-..._...blY...6.&.b2i.!8.(..O{.G...O...W..........^Hc..28w.s....^....>.N3...\d...u.~5....w.-.?.'<..D?..tP....f...o.i.....V...D.D...%..z....2F.....#.3..?Q1^..(xB..1`..%..m.(Z{kK.#. .O.B.}.%..7sq........P.S..'.w.$.!.&_)].B..\.m.$....Uh.e..l.....c.3w.I..\e....t..u..x+rX....b`\..C.uc.....t...t......w."X..Ik....A.F.....666.a`s.5EW..F.Ok.:E...3P...6Jd.m...&..?.M.E.g.jm\|... .=.z\.{f/.w....F}}.O..%6..]......m.....k.......6........D/..M...q...(....+r.>..x.j#..b.Y..9bt..5.._T.e.H...7.0o9.\|fQ.c..............ynF...;F....{...z](.Z.R.?.>.@..e\|.....r....9@Uo..\|.?4.P.@.]Dz....R/.~...5.V.-.*..P......5y....#..............x._....z6..2..'_.[.-O..H...Pq...v..\..O.O....#.a.k,.."\|9{.6......U\.w...L.'.m ~......s"T]q..E...q.\.a..{...].68..+6.k?...w)J..@.....).`..m..>r.?....Ni1.jJS...u.....2Rd....".ZX.\k..FW.....`.....mf..s$.^.b._(4v.O...-pV....]y5."fq..:.a...=.w...o.9.....KNs.Rh..#6..../S...

C:\Users\user\AppData\Local\Temp\Pee

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.99726925342249
Encrypted:	true
SSDEEP:	1536:DUo0jScf1eJ1JZ8FBNX5VCIho3Jpr1P3o73mvZa7OrkF/AME2vgFK0rVv:DIjS5j8NJVh63JpFKcYV/+tFlv
MD5:	D6656D7A38E0D4C6BE1A7A61FF2D066C
SHA1:	B9D826B6915D10C80C91A4F43CA6E4F78EE02E61
SHA-256:	9EC948BCC257BABFF912D8C949BE2EE09F8ADA892E02F1A76693C363DC4C3477
SHA-512:	D80A3EEE6F4018B96A7EACF0ED7FD655FCFCD475D797EEFEFBCB320845944342B7836D9DFBCEFB07D28A8EC4FA0B4CD4288B7DC79B07361D4DA4BE668C98BD31
Malicious:	false
Preview:	9y........C...N.ub+..........RNgS.v.......Y...i&.K.C...-..M..L.ok.?IXL..O.L...f..}{...W\X.>.....(.M.};r.....h....+..h.....t8....j.9.7.K....X;..+.T.x.{.Hi..B..`.-.ks...im^<J......#w.#.pT q.e.S.8..X.V.6.m..ZVp.S.mh..J./..o[OH..z..8...@...Y..}.j.9...(..<.........F..VH...h..+..>.R....?..."....._.9.C..]l.n..C.h. 1.....l.....G...(......@C....I.q./..M.t.Y...>..e....61...u.w&..Jc0KB..iMR....pU'...G.... X.p..t.+.E...:....=na.../...:....u.x.r.X;......AV..29t.5..T.6.^@.<v/..5.(....vv..}.....C..=..[h....(.8...$.d.a+d...=.uIN..`.u....%.....TN.I..........\|.y...%.`. ....&.....>!..dT.4z.\|.... .]..)....^k%.t..nC...e....WQi....T..;QM......y.E.af...n....L.)m?...>..!....b.......5..r......t.<!..J...,T.L~..R.$AB@.../..."....~I...%.......Of..)..D."U.I;..\.'o.........g"..@y^U3..[...)....c6b.`.<.i.L......M..I..VF}.A^.Q...vM....N..ns7C...":...o...%"..2'fc...Di}.jT..^i.$...OD......V..?v.u(...8c.0<Rg....-.+#?p+..z.+.o..s..Z%...h.'^.g....0.<H...A"/.G........i...

C:\Users\user\AppData\Local\Temp\Similarly

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	6.705586878305298
Encrypted:	false
SSDEEP:	3072:L2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAU4Ci:qUDtf0accB3gBmmLsiS+SAhCi
MD5:	CB8247D2065626D0EBA0E67DE7570918
SHA1:	59CB956BC2A1B533D2A10F6223DA2752509933ED
SHA-256:	1A65DE05BA90141D74B32113B1E750DA78FDF01FFBFF5E0F01CA1A9533997152
SHA-512:	A06654A2CF2336D8B418F03B5A5E66010F82BE7546A3C41A96E97F0B5BF2156979E87748E99E69E65B71A65055D6ECF5ADEB94CCA947E0DD5FC100B234CB26B3
Malicious:	false
Preview:	.D$...0..4...E.3.A.H..09L$$v&.E.j).H..I...............\|$...L$.......D$..L$ ..A....T$ f.........L$(.4.._3.^..]...U..SVWj.......j0.'O....Y.K..D....E..c...C .E.j..C$..O....Y.u...f...9f..S..s(."....M.;O.\|..E...;G.v..G..O..C(_^[]...U..V.u.W...~........j.h.....v$.v .Vp....&..O......u.!F..G..4..E..O.P....._^]....F..0..U..SV..j.[.F.9F.t S.XN..Y.M......V..N.....F.^[]......j.X;.r...3.F...W.......Q.MN...~....Yt..F...t....P.v.W.E^...v..1N......~._.U....S.].VW.}..s..M.jN..Y...f9H..M........E....x.........B......j...p..E.e...e..PWS.E......O...M..X.....t.........x......S....f.x.O..i....A....E..0.~..uM.6.}...M.../....u../...RP...9......M.E..0.x2....t....s.jNY...f9H.t.3._^[....3..M..4...U..QQW.u....C....e...E.P.u....u...;....u%.}........QQ....YP.u....u..s..._.....@(..U..}..W..t&.}..t . ....}.........G..8....t......._]...V..V........2...u.^......t....A...V..._...j..:L..Y.......F.^.3.@9A........U..d.,.........\5M.V;..........M.j*...b.....t...^..\5M.V.JP...=\5M..Yu.h.'D..N..V..O..YY.

C:\Users\user\AppData\Local\Temp\Sporting

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	ASCII text, with very long lines (966), with CRLF line terminators
Category:	dropped
Size (bytes):	25868
Entropy (8bit):	5.109980921107115
Encrypted:	false
SSDEEP:	384:5ODOG7KJ8zcohbsA3o4Ec9QV5GpcFGeEg9p+u57DVU1Kg50WSxvo0:8DOGG8lbsAYPc9Qm2GeE0p+i7D0K3x/
MD5:	3E5DD12107A5CD41B5EAF18E067BCF18
SHA1:	3905DAC8CC40D53ACF7A09FF2A5E439EFA6EF128
SHA-256:	98BB92982EDF7AF851F915C2359C35A9003E06E7765CDAA10E8E3D8B436F0F8A
SHA-512:	4704CB60E561B0FD656B92F47A6133F40A24A1D524DABD6DC5D36608DA76A768FE8542D7B73D70CA073A0A9D0FC997EAAAC2CF09D4E046D47A7A37821773748B
Malicious:	false
Preview:	Set Villa=l..cQeDPrints-Pack-Spouse-Mt-Hawaiian-Flags-..wqYoga-Puts-Atlas-Venice-Terry-Dim-Polish-..vhMile-Chose-Academics-Mountains-Bookstore-Overseas-Lie-Knew-Damage-..MNhAttribute-Antiques-..jWWCreated-..LNQNPts-Rehabilitation-Painted-Oclc-Establishing-Monday-Cambridge-Jefferson-Spend-..fLLyric-Scoring-Chicago-Diary-Venue-..MQkjKnows-Fax-Tract-Finishing-Fruits-Durable-Sick-Emma-Supreme-..OmXInfant-Political-..Set Hearts=K..RNemConsult-..ZqmcHazardous-Enable-Guardian-Rule-Largely-Connectors-Crown-..GwSizes-Get-Considerable-Men-..uljExisting-Rays-..WpdMeasured-Headed-Determining-Morrison-Searched-Southeast-Leather-Remainder-Flashing-..NywNeo-Creating-Smithsonian-Grocery-December-Booth-Theater-..vTPDoor-Gel-Practices-..nEphPersonalized-Gains-Implies-Moldova-Workout-Syndrome-Initial-..Set Boost=s..CDSuperintendent-Think-Dance-Sao-Indoor-Fed-Fallen-Competitors-..WnpMPhotographs-Condo-Memorial-Components-Electric-Adding-Arc-..XvqRabbit-Attendance-Possibilities-Dicks-Todd-Independence-Mosc

C:\Users\user\AppData\Local\Temp\Sporting.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (966), with CRLF line terminators
Category:	dropped
Size (bytes):	25868
Entropy (8bit):	5.109980921107115
Encrypted:	false
SSDEEP:	384:5ODOG7KJ8zcohbsA3o4Ec9QV5GpcFGeEg9p+u57DVU1Kg50WSxvo0:8DOGG8lbsAYPc9Qm2GeE0p+i7D0K3x/
MD5:	3E5DD12107A5CD41B5EAF18E067BCF18
SHA1:	3905DAC8CC40D53ACF7A09FF2A5E439EFA6EF128
SHA-256:	98BB92982EDF7AF851F915C2359C35A9003E06E7765CDAA10E8E3D8B436F0F8A
SHA-512:	4704CB60E561B0FD656B92F47A6133F40A24A1D524DABD6DC5D36608DA76A768FE8542D7B73D70CA073A0A9D0FC997EAAAC2CF09D4E046D47A7A37821773748B
Malicious:	false
Preview:	Set Villa=l..cQeDPrints-Pack-Spouse-Mt-Hawaiian-Flags-..wqYoga-Puts-Atlas-Venice-Terry-Dim-Polish-..vhMile-Chose-Academics-Mountains-Bookstore-Overseas-Lie-Knew-Damage-..MNhAttribute-Antiques-..jWWCreated-..LNQNPts-Rehabilitation-Painted-Oclc-Establishing-Monday-Cambridge-Jefferson-Spend-..fLLyric-Scoring-Chicago-Diary-Venue-..MQkjKnows-Fax-Tract-Finishing-Fruits-Durable-Sick-Emma-Supreme-..OmXInfant-Political-..Set Hearts=K..RNemConsult-..ZqmcHazardous-Enable-Guardian-Rule-Largely-Connectors-Crown-..GwSizes-Get-Considerable-Men-..uljExisting-Rays-..WpdMeasured-Headed-Determining-Morrison-Searched-Southeast-Leather-Remainder-Flashing-..NywNeo-Creating-Smithsonian-Grocery-December-Booth-Theater-..vTPDoor-Gel-Practices-..nEphPersonalized-Gains-Implies-Moldova-Workout-Syndrome-Initial-..Set Boost=s..CDSuperintendent-Think-Dance-Sao-Indoor-Fed-Fallen-Competitors-..WnpMPhotographs-Condo-Memorial-Components-Electric-Adding-Arc-..XvqRabbit-Attendance-Possibilities-Dicks-Todd-Independence-Mosc

C:\Users\user\AppData\Local\Temp\Spring

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	15035
Entropy (8bit):	7.417731296548406
Encrypted:	false
SSDEEP:	384:TO/ChZrzmZGhLdXVaeCVrVEVFJ8ZcGwGBk7/UMQ3rw:TO/ChgZ45VatJVEV3GPkjF
MD5:	7AE2204A4C1E7DE61A10CCD94949B1BB
SHA1:	43248BE515DC2EC40CA1E69F448B77E5B4EEA72F
SHA-256:	1D1D3C1847F04374420D6CBABE91E193565BC1DBEDDECF26BDFAFC975484E15E
SHA-512:	149F383D467C2B7260BBF3022E57EE2B7A0AAB0A3166525B2E8CA9ABE1191DB4E11CFD053A8ACA36E8EE89F34D5DD38824FBCF66D91FB2B22306501282A42468
Malicious:	false
Preview:	3.3.3.4.4F4.4.4.4.5.5J5e5.5.5.6.6.7&7_7l7.7.7.7.7.7.8{8.8.8.8.809C9.9.9.9.:r:.:.:.:.:.:.;.;.;2;>;.;.;.;E<f<o<.<.<.=.=.=.=.=O>.>.?.?J?g?w?.?.?...P......v0.0#1\1o1.1.1.1.1.1.2#2M2.2.2>3.3.3.3.3.4B4.4.4.575.5.546.6"7G7N7i7.7.7.7.7t8.8.8E9p9.9.9.9@:l:.:.:.:4;.;.;&<]<q<.<.<.<!=C=.=.=.=.>">H>N>.>.>.>.?.?.?.?.?.?.?.?.`.......0j0.0.0.1\1.1.1.1>2g2.2.2.3b3.3.3.3.3.3.3.3.3.4.4.4.4.4.4.4.4l4y4.4.4N5^5.5.5.6.6$6C6g6.6.6.727P7V7r7.7.7.78;8H8Q8}8.8.8.8.8.8.9.9-9H9Y9.9.9.9.9.94:L:p:v:.:.:.:.:.:.;.;.;6<_<.<.<.<.=O=.=.=.=.>.>_>.>.>.>.?w?.p......00L0.0.0.171C1.1.1 2a2.2.373=3]3m3.3.3.3.4B4.4.4_5u5.5.5.5.5m6.6.6.6.6.7:7H7.7.8%88/8=8n8.8.8.8.8.8.8.9.979P9W9a9.9.9.9 :(:K:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.;.;.;.;U;i;.;.;.;.;.;.;.;.<.<.<.<7<G<j<.<.<.<.=.=D=g=r=.=.=.=.=.=.=.=.=.>.>;>a>w>.>.>.>.>.>.?.?f?.?.?.?.?.?.?.?......X....0.0!0J0^0m0}0.0.0.0.0.0.0.0.0.1.1L1\1n1.1.1A2I2U2e2}2.2.2.2.2.2.2.2.3.3,3;3K3`3.3.3.3.3.3.3.3.4.4.4+4?4L4T4b4s4.4.4.4.535@5H5R5e5m5x5.5.5.5.5.5.5.5.5.6(606:6Y6n6{6.6.6.6.6.7.7.7/7B7g7.

C:\Users\user\AppData\Local\Temp\Terrible

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.579393870820363
Encrypted:	false
SSDEEP:	1536:xaynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjL/:xVnBypIbv18mLthfhn/
MD5:	27919EAE398AF5A4E9FB628FAAD7DDA9
SHA1:	FE590D9B57194E3D2F94E3F3C0722D233DB3D61A
SHA-256:	F73E67BB1F85F7D9C40894F9FBB387243F3DAEB729FBDD19B66A284A4171DC2D
SHA-512:	CD4BFD0B71FBF7DD21F08E69B6D316E74404F2759FA29C430B90BB23715A30126AD019847563D9EAEA2484F273189706D2FFF24FA15EE02143F381F4143BE085
Malicious:	false
Preview:	.X.....u.........U......#]..J.......#..E...3..F....._^[....U..SV.u.W.N..I......N..]..9.q...x.......................t..........i...........o....C.....3..;_^[]...U..S.].VW.C..E..C....1...3...F9u.v..K.........3.F;u.r.u.........>3._.F.....^[]...U.....E.V.@.......QQ..$......u.......].......E...j....F......g...RP.E.P.q...P........M.....3.^....U..E.....@.V....}.....u+.M..W...j..M.......M..E.P.....M..^.......=....~;.M.h..I.......H..\|1...D1.t..@8.@......\|1...D1.t..@8.@...C=....}..M.f.E.3.f.E..E.P.e....$....E..M..E...6....M...V.F...V.....Y3.^....U..E.....@.V.........u(.M.....j..M.......M..E.P......M......U.M.=....~8h..I........H..\|1...D1.t..@8.@......\|1...D1.t..@8.@....f.E.3.f.E..E.P...3.^....U..E.....@.SVW.0.....=....v..U.j....F...3.CY..u(...H..\|9...D9.t..@8.X..\|9...D9.t..@8.@...E.9X........@..H........tM...tC...uGj..u..E..u.P.[......?....M.E..U......u........E....F......Qj.X......3.P.u..E..u.P......M.P.~....M..N....#.}...v..?....E......v..E.j..G.[._._^3.[....U..QQ

C:\Users\user\AppData\Local\Temp\Weather

Download File

Process:	C:\Users\user\Desktop\ModelsPreservation.exe
File Type:	unknown demand paged pure executable
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.333910060206016
Encrypted:	false
SSDEEP:	3072:meoMmOqDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0FI:nO5bLezWWt/Dd314V14ZgP0JaAo
MD5:	F14E4CEB8D2725C35DA2722BC7662BE4
SHA1:	20C8321318F8884BFE9E0E15F101705D8B4EC2AC
SHA-256:	5154D72E374CB7D9F7C77D11C57176B5597F51BB9E273073157EB2E2ABF1F3D9
SHA-512:	90192FCD089682C05E8A1EA8E2A20900E9843519BD3AE6CA4B469A803542B784B8E0FA003FF237B74384E0EC833A1A4961842E90026D72F8560FFB7E0FC7C6B0
Malicious:	false
Preview:	......7_3.^]...U.......S.].VW...K....x..t@.u.....<...&.3.A.N....P..\|:...D:.t..@8.H..D:..\|:..t..@8.@........L$...{..rW.I.j)......uI.g.........t$.y9.u....e<...&..F........H..\|9...D9.t..@8.@......D9..\|9...C..L$..d$...p...n...\|$..t!.L$.......L$..p...<...D$......t$..C..P....x..u.....3..t$..D$.j..u.RP.X.....Q..\|:...L:.t..I8.A..\|:...D:.t..@8.L$..@...;.._^3.[..]...U..E..@....x..u....x..t.V.u....r;...&..F.....^3.]...U........E.SVW.@...3.\$..0...^....N..D$.P.T$...2..Y..uA.u.....;...F..........H..D9.8\9.t..@8.@......D9.8\9.t..@8.X.....8\$...f....t$.Sj.....I..u............0.I..........h..L..L$...+..Q.L$...t....t..t$.j.j.....I....M..j.j..H....G......H..\|9...D9.t..@8.@......\|9...D9.t..@8...@...C:...&..F......L$..m...Lj.P...H...........H..\|9...D9.t..@8.@......\|9...D9.t..@8...@....9...&..F.......tzj.S....I...uQP..0.I.P...H..........H..\|9...D9.t..@8.@......\|9...D9.t..@8...@...9...&..F.....S..`.I....u....m9...F......._^3.[..]...U..Q.E.SVW.@....E...0...]....N..E.P.U...0...u...Y...!9....u2.&

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.968795535601367
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ModelsPreservation.exe
File size:	1'405'721 bytes
MD5:	bcae44d5bf6fcd34c12ef6a6502faf7c
SHA1:	7b383cb56e8070e1595da9d44885f2a9eb8037cf
SHA256:	f697d689701ccacd6870c3fc077cf6d12585dc6db60b3ab7db483e3d7180f966
SHA512:	9f6229c4c6e3363746499be720d7fa466a6646bfd3adb46f0c66b23af923d9fec91bfcfcd16f8b4e746bfdf64bad807eef5b0250c659e4c3b109ab24c2b4d3b2
SSDEEP:	24576:YHHOcwqlg+qnztwE240yrFIrStE5ouCE4g23X/pQIjFvqxFx+vIK/kGM3ESw8bIX:pctt8440yrFIrbd4ls8v9/kGiEhAIX
TLSH:	585533832BE6C4B6EED25FB420F1CF8BEFF5E09400BE944FA2610D5C2921B611F65624
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	587cbc79f1b8a438

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	23/01/2024 11:24:28 12/03/2025 17:08:47
Subject Chain	E=a.tozzi@entersrl.it, CN=Enter Srl, OU=Enter Srl, O=Enter Srl, STREET=VIA CARLO ALBERTO DALLA CHIESA 18, L=Grottammare, S=Ascoli Piceno, C=IT, OID.1.3.6.1.4.1.311.60.2.1.3=IT, SERIALNUMBER=01524500442, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	D5D66EA7AE498CF896CF422DE5426590
Thumbprint SHA-1:	232E8A3F99CB8B202BE4DD8A235590F838B29038
Thumbprint SHA-256:	9B04FC852CDCBDA62D870E4112459D2A2A30586909E0E76B77AFA5DDF6FBA631
Serial:	5600D74B2CE1156218EEA30D

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F15C4C3882Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F15C4C3850Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F15C4C384FBh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F15C4C35DFAh
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F15C4C381D1h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F15C4C35E83h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F15C4C35DFAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x59272	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x153c31	0x36e8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x59272	0x59400	d63356c96160e25dd3a67d46fb3843c9	False	0.969212294292717	data	7.898318519476554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x15a000	0xfd6	0x1000	4d22231cfcfbd14a09d89e17594ca6eb	False	0.597900390625	data	5.5820136226008135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x100280	0x4dc25	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9961632773523474
RT_ICON	0x14dea8	0x56f7	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0007186812199613
RT_ICON	0x1535a0	0x1b2a	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0015818234109866
RT_ICON	0x1550cc	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.415073230268511
RT_ICON	0x157734	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.47540983606557374
RT_ICON	0x15885c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6143617021276596
RT_DIALOG	0x158cc4	0x100	data	English	United States	0.5234375
RT_DIALOG	0x158dc4	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x158ee0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x158f40	0x5a	data	English	United States	0.7888888888888889
RT_MANIFEST	0x158f9c	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T11:41:09.112353+0100	2058039	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brendon-sharjen .biz)	1	192.168.2.5	50033	1.1.1.1	53	UDP
2025-01-10T11:41:09.128921+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.5	62395	1.1.1.1	53	UDP
2025-01-10T11:41:09.140424+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.5	56761	1.1.1.1	53	UDP
2025-01-10T11:41:09.151646+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.5	54973	1.1.1.1	53	UDP
2025-01-10T11:41:09.162592+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.5	56710	1.1.1.1	53	UDP
2025-01-10T11:41:09.180248+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.5	62490	1.1.1.1	53	UDP
2025-01-10T11:41:09.191190+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.5	64223	1.1.1.1	53	UDP
2025-01-10T11:41:09.202115+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.5	57863	1.1.1.1	53	UDP
2025-01-10T11:41:09.214695+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.5	50274	1.1.1.1	53	UDP
2025-01-10T11:41:09.871584+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49795	104.102.49.254	443	TCP
2025-01-10T11:41:10.364434+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	49795	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:41:09.242162943 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.242216110 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:09.242306948 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.243506908 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.243522882 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:09.871437073 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:09.871583939 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.875940084 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.875948906 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:09.876198053 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:09.919148922 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.928848982 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:09.971324921 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364474058 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364500046 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364522934 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364533901 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364556074 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364594936 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.364619970 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.364692926 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.364692926 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.364692926 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.448458910 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.448498011 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.448549032 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.448692083 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.449744940 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.449779987 CET	443	49795	104.102.49.254	192.168.2.5
Jan 10, 2025 11:41:10.451077938 CET	49795	443	192.168.2.5	104.102.49.254
Jan 10, 2025 11:41:10.451086998 CET	443	49795	104.102.49.254	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:40:47.493218899 CET	58687	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:40:47.501607895 CET	53	58687	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.112353086 CET	50033	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.122667074 CET	53	50033	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.128921032 CET	62395	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.137542009 CET	53	62395	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.140424013 CET	56761	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.148734093 CET	53	56761	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.151645899 CET	54973	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.160948038 CET	53	54973	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.162591934 CET	56710	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.171382904 CET	53	56710	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.180248022 CET	62490	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.189496994 CET	53	62490	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.191190004 CET	64223	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.200666904 CET	53	64223	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.202115059 CET	57863	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.211920977 CET	53	57863	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.214694977 CET	50274	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.226413965 CET	53	50274	1.1.1.1	192.168.2.5
Jan 10, 2025 11:41:09.229726076 CET	64614	53	192.168.2.5	1.1.1.1
Jan 10, 2025 11:41:09.236486912 CET	53	64614	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:40:47.493218899 CET	192.168.2.5	1.1.1.1	0x946c	Standard query (0)	uCnxmvEiQOcCxFeKjPHXFMBLCjf.uCnxmvEiQOcCxFeKjPHXFMBLCjf	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.112353086 CET	192.168.2.5	1.1.1.1	0x2dfc	Standard query (0)	brendon-sharjen.biz	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.128921032 CET	192.168.2.5	1.1.1.1	0xad52	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.140424013 CET	192.168.2.5	1.1.1.1	0x50ef	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.151645899 CET	192.168.2.5	1.1.1.1	0xad9a	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.162591934 CET	192.168.2.5	1.1.1.1	0xeb6d	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.180248022 CET	192.168.2.5	1.1.1.1	0x974e	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.191190004 CET	192.168.2.5	1.1.1.1	0x1cb0	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.202115059 CET	192.168.2.5	1.1.1.1	0x7f0f	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.214694977 CET	192.168.2.5	1.1.1.1	0x35bd	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.229726076 CET	192.168.2.5	1.1.1.1	0x45c2	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:40:47.501607895 CET	1.1.1.1	192.168.2.5	0x946c	Name error (3)	uCnxmvEiQOcCxFeKjPHXFMBLCjf.uCnxmvEiQOcCxFeKjPHXFMBLCjf	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.122667074 CET	1.1.1.1	192.168.2.5	0x2dfc	Name error (3)	brendon-sharjen.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.137542009 CET	1.1.1.1	192.168.2.5	0xad52	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.148734093 CET	1.1.1.1	192.168.2.5	0x50ef	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.160948038 CET	1.1.1.1	192.168.2.5	0xad9a	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.171382904 CET	1.1.1.1	192.168.2.5	0xeb6d	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.189496994 CET	1.1.1.1	192.168.2.5	0x974e	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.200666904 CET	1.1.1.1	192.168.2.5	0x1cb0	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.211920977 CET	1.1.1.1	192.168.2.5	0x7f0f	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.226413965 CET	1.1.1.1	192.168.2.5	0x35bd	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:41:09.236486912 CET	1.1.1.1	192.168.2.5	0x45c2	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49795	104.102.49.254	443	6608	C:\Users\user\AppData\Local\Temp\306780\Thus.com

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:41:09 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-10 10:41:10 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 10 Jan 2025 10:41:10 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=6871b4ece5a763eff56b3d4c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-10 10:41:10 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-10 10:41:10 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Target ID:	0
Start time:	05:40:42
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ModelsPreservation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ModelsPreservation.exe"
Imagebase:	0x400000
File size:	1'405'721 bytes
MD5 hash:	BCAE44D5BF6FCD34C12EF6A6502FAF7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:40:42
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Sporting Sporting.cmd & Sporting.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:40:42
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:40:44
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x300000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:40:44
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x7f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:40:45
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x300000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:40:45
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x7f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:40:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 306780
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:40:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "wallpapers" Broken
Imagebase:	0x7f0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:40:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Nhs + ..\Opposed + ..\Mighty + ..\Pee + ..\Exact + ..\Cheese g
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:40:46
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\Temp\306780\Thus.com
Wow64 process (32bit):	true
Commandline:	Thus.com g
Imagebase:	0xbf0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000003.2338328323.0000000003C71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000003.2339909158.0000000003BBA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000002.2363806123.0000000003C70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000002.2363191959.000000000148C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000002.2363551998.0000000003B70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000B.00000003.2339521170.0000000003F4D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:40:46
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x260000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	28

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,0042A67C,759223A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

{, xrefs: 0040537E
New install of "%s" to "%s", xrefs: 004051AE

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

~nsu.tmp, xrefs: 00403B23
NSIS Error, xrefs: 0040390E
SeShutdownPrivilege, xrefs: 00403C42
/D=, xrefs: 004039D2
\Temp, xrefs: 00403A47
NCRC, xrefs: 004039A8
_?=, xrefs: 00403A90
Error launching installer, xrefs: 00403AA9

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename on reboot: %s, xrefs: 00401943
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Jump: %d, xrefs: 00401602
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes failed., xrefs: 004017A1
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Sleep(%d), xrefs: 0040169D
CreateDirectory: "%s" (%d), xrefs: 004017BF
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Aborting: "%s", xrefs: 0040161D
Call: %d, xrefs: 0040165A
BringToFront, xrefs: 004016BD
detailprint: %s, xrefs: 00401679
Rename: %s, xrefs: 004018F8

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

.exe, xrefs: 00405A69
"F, xrefs: 00405A4B
_Nb, xrefs: 00405AFD
.DEFAULT\Control Panel\International, xrefs: 004059C5
RichEdit, xrefs: 00405BF0
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
@jG, xrefs: 00405AF2
F, xrefs: 00405A22
RichEd20, xrefs: 00405BC9
RichEdit20A, xrefs: 00405BE2, 00405BE7
RichEd32, xrefs: 00405BD4

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,%MercuryBelow%,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,%MercuryBelow%,%MercuryBelow%,00000000,00000000,%MercuryBelow%,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,0042A67C,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
%MercuryBelow%, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: wrote %d to "%s", xrefs: 00401BD0
File: error creating "%s", xrefs: 00401AF0
File: error, user abort, xrefs: 00401B53
File: error, user retry, xrefs: 00401B40

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: %MercuryBelow%$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-395844392
Opcode ID: 64a557673ae3d0e019bdca1bc4e77ebfe7370d638d91dc23aa74aa5952768e1c
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: 64a557673ae3d0e019bdca1bc4e77ebfe7370d638d91dc23aa74aa5952768e1c
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
Null, xrefs: 004036AA
soft, xrefs: 004036A1
Error launching installer, xrefs: 00403603
Inst, xrefs: 00403698

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 60015d4ad0f4b5f5eae55729fc88f45e330dc420916319a7d833a41d7a943f83
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 60015d4ad0f4b5f5eae55729fc88f45e330dc420916319a7d833a41d7a943f83
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,0042A67C,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

Set Villa=lcQeDPrints-Pack-Spouse-Mt-Hawaiian-Flags-wqYoga-Puts-Atlas-Venice-Terry-Dim-Polish-vhMile-Chose-Academics-Mountains-Bookstore-Overseas-Lie-Knew-Damage-MNhAttribute-Antiques-jWWCreated-LNQNPts-Rehabilitation-Painted-Oclc-Establishing-Mond, xrefs: 004033FD
pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Villa=lcQeDPrints-Pack-Spouse-Mt-Hawaiian-Flags-wqYoga-Puts-Atlas-Venice-Terry-Dim-Polish-vhMile-Chose-Academics-Mountains-Bookstore-Overseas-Lie-Knew-Damage-MNhAttribute-Antiques-jWWCreated-LNQNPts-Rehabilitation-Painted-Oclc-Establishing-Mond$pAB
API String ID: 651206458-2797805329
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,0042A67C,759223A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,0042A67C,759223A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00906090), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
%MercuryBelow%, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: %MercuryBelow%$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-4263098098
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
%MercuryBelow%, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: %MercuryBelow%$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1611999083
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,0042A67C,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

N, xrefs: 00404C32
, xrefs: 00404F65
@, xrefs: 00404BBC
M, xrefs: 00404B6F

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

Delete: DeleteFile failed("%s"), xrefs: 00406E29
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
ptF, xrefs: 00406D1A
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
\*.*, xrefs: 00406D2F

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,0042A67C,759223A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
F, xrefs: 004046A0

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

name, xrefs: 00406FEB
GetTTFNameString, xrefs: 00406F33
%s: failed opening file "%s", xrefs: 00406F38

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,0042A67C,759223A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,0042A67C,759223A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406858
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952
F, xrefs: 00406A7F

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

Kernel32.DLL, xrefs: 004065C7
Module32NextW, xrefs: 0040660A
Module32FirstW, xrefs: 004065FF
Process32NextW, xrefs: 004065F4
CreateToolhelp32Snapshot, xrefs: 004065E1
Unknown, xrefs: 00406528
EnumProcesses, xrefs: 004064AE
PSAPI.DLL, xrefs: 00406490
GetModuleBaseNameW, xrefs: 004064C0
EnumProcessModules, xrefs: 004064B6
Process32FirstW, xrefs: 004065E9

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

open, xrefs: 0040430B
N, xrefs: 00404298
F, xrefs: 004042D3

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

NUL, xrefs: 00406ACA
^F, xrefs: 00406ACF
%s=%s, xrefs: 00406B6F
plF, xrefs: 00406B54
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: d135351413aed0fa2e41fb55b591d9c8f09a23be57b10ac43573759c3ccf12cb
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: d135351413aed0fa2e41fb55b591d9c8f09a23be57b10ac43573759c3ccf12cb
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 4ef21115088bf02e153ee67726e536285437d58c513b54df1b4c7782176e81a7
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 4ef21115088bf02e153ee67726e536285437d58c513b54df1b4c7782176e81a7
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,0042A67C,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,0042A67C,759223A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,0042A67C,759223A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00064A00,00000064,00157319), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00906090), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Section: "%s", xrefs: 004050A5
Skipping section: "%s", xrefs: 004050E1

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,0042A67C,759223A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.2094408626.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2094388060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094430983.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094455824.00000000004BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2094616051.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ModelsPreservation.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: Thus.comPID: 6608, Parent PID: 3184COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 00BF5FC8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00BF5FF7

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

GetCurrentProcess.KERNEL32(?,00C8DC2C,00000000,?,?), ref: 00BF6123
IsWow64Process.KERNEL32(00000000,?,?), ref: 00BF612A
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00BF6155
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00BF6167
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00BF6175
FreeLibrary.KERNEL32(00000000,?,?), ref: 00BF617C
GetSystemInfo.KERNEL32(?,?,?), ref: 00BF61A1

Strings

GetNativeSystemInfo, xrefs: 00BF6161
|O, xrefs: 00C350F7
kernel32.dll, xrefs: 00BF6150

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 26fa03554ff4d6000abefbdf63acebf7149ac5025828a00909252971c25bc2ac
Instruction ID: 10bc44d11398d2fbb1306b2b2fe4edf3170af995388732471a180739d48aa714
Opcode Fuzzy Hash: 26fa03554ff4d6000abefbdf63acebf7149ac5025828a00909252971c25bc2ac
Instruction Fuzzy Hash: A5A1A13591A2C4CFC716CB68FC85BAD3FAC6B26300F1C59D9D981A7272C66D4648CB35

Function 00BF338B Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00BF3368,?), ref: 00BF33BB
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00BF3368,?), ref: 00BF33CE
GetFullPathNameW.KERNEL32(00007FFF,?,?,00CC2418,00CC2400,?,?,?,?,?,?,00BF3368,?), ref: 00BF343A

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

Part of subcall function 00BF425F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00BF3462,00CC2418,?,?,?,?,?,?,?,00BF3368,?), ref: 00BF42A0

SetCurrentDirectoryW.KERNEL32(?,00000001,00CC2418,?,?,?,?,?,?,?,00BF3368,?), ref: 00BF34BB
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00C33CB0
SetCurrentDirectoryW.KERNEL32(?,00CC2418,?,?,?,?,?,?,?,00BF3368,?), ref: 00C33CF1
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00CB31F4,00CC2418,?,?,?,?,?,?,?,00BF3368), ref: 00C33D7A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00C33D81

Part of subcall function 00BF34D3: GetSysColorBrush.USER32(0000000F), ref: 00BF34DE
Part of subcall function 00BF34D3: LoadCursorW.USER32(00000000,00007F00), ref: 00BF34ED
Part of subcall function 00BF34D3: LoadIconW.USER32(00000063), ref: 00BF3503
Part of subcall function 00BF34D3: LoadIconW.USER32(000000A4), ref: 00BF3515
Part of subcall function 00BF34D3: LoadIconW.USER32(000000A2), ref: 00BF3527
Part of subcall function 00BF34D3: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BF353F
Part of subcall function 00BF34D3: RegisterClassExW.USER32(?), ref: 00BF3590

Part of subcall function 00BF35B3: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BF35E1
Part of subcall function 00BF35B3: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BF3602
Part of subcall function 00BF35B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00BF3368,?), ref: 00BF3616
Part of subcall function 00BF35B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00BF3368,?), ref: 00BF361F

Part of subcall function 00BF396B: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BF3A3C

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00C33CAA
runas, xrefs: 00C33D75
AutoIt, xrefs: 00C33CA5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 683915450-2030392706
Opcode ID: beafc556d6ec68373cc010211e7e728f0d5c906ec538e186a4f142759a44ca2e
Instruction ID: d24d91fccccc6f9cc803fd50ae94d0d9cf87d7da54e4e2f6d1bb52f9f8ef1da8
Opcode Fuzzy Hash: beafc556d6ec68373cc010211e7e728f0d5c906ec538e186a4f142759a44ca2e
Instruction Fuzzy Hash: A351F8701083886BDB05EF60EC45FBE7BF89F94740F04056CF692531A2DB648A4ED762

Function 00C5DC54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BF55D1,?,?,00C34B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00BF5871

Part of subcall function 00C5EAB0: GetFileAttributesW.KERNEL32(?,00C5D840), ref: 00C5EAB1

FindFirstFileW.KERNEL32(?,?), ref: 00C5DCCB
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C5DD1B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00C5DD2C
FindClose.KERNEL32(00000000), ref: 00C5DD43
FindClose.KERNEL32(00000000), ref: 00C5DD4C

Strings

\*.*, xrefs: 00C5DC9D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: b096225445b1ebd99233fb431044ae20a04c64604eeccfe276854011ed876112
Instruction ID: 54698da04a184794b50e43a72af1f0c72ccaeaea35b4bc256ceb860fba61b481
Opcode Fuzzy Hash: b096225445b1ebd99233fb431044ae20a04c64604eeccfe276854011ed876112
Instruction Fuzzy Hash: 31317E35008349ABC310EF20C8859AFB7E8AE95301F404D9DF9E683191EB21DE0DCB67

Function 00C5DD87 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C5DDAC
Process32FirstW.KERNEL32(00000000,?), ref: 00C5DDBA
Process32NextW.KERNEL32(00000000,?), ref: 00C5DDDA
CloseHandle.KERNEL32(00000000), ref: 00C5DE87

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7e0f0d93d2a144f8e3f945575736493f24a45ddcd71f46ec34ff3c738d7d609d
Instruction ID: b105500e76693d452cae8ce44df75fb684f8be5311eccc52916d21ef4c27c50e
Opcode Fuzzy Hash: 7e0f0d93d2a144f8e3f945575736493f24a45ddcd71f46ec34ff3c738d7d609d
Instruction Fuzzy Hash: DB317E710083049FD310EF50D885FAEBBE8AF99350F04096DFA82871A1DB719A89CB96

Function 00BFEE50 Relevance: 21.6, APIs: 14, Instructions: 614windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00BFEF07
timeGetTime.WINMM ref: 00BFF107
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BFF228
TranslateMessage.USER32(?), ref: 00BFF27B
DispatchMessageW.USER32(?), ref: 00BFF289
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BFF29F
Sleep.KERNEL32(0000000A), ref: 00BFF2B1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: f757fdcaa8a0dc24386e96a8cd6f8d053806a2030dd9eb3610e55aab0a89d9a8
Instruction ID: 3ad1199200eb44a253a5b01d6786ed721c022041c03b7ef6c230e0bcf28ec646
Opcode Fuzzy Hash: f757fdcaa8a0dc24386e96a8cd6f8d053806a2030dd9eb3610e55aab0a89d9a8
Instruction Fuzzy Hash: BE32E370604246EFD728CF24C884FBAB7E5FF81304F24456DE665872A1DB71E988CB86

Function 00BF3624 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BF3657
RegisterClassExW.USER32(00000030), ref: 00BF3681
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BF3692
InitCommonControlsEx.COMCTL32(?), ref: 00BF36AF
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BF36BF
LoadIconW.USER32(000000A9), ref: 00BF36D5
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BF36E4

Strings

TaskbarCreated, xrefs: 00BF3687
0, xrefs: 00BF3639
AutoIt v3 GUI, xrefs: 00BF3673
+, xrefs: 00BF3640

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b597888b35b2e63cb806ef268b94ff1a0882a60f9473701b0472f7e32c460fe3
Instruction ID: 35b3a664e4ca84c29e3d470067665aa3175b0328b1fc642bc3d59c52fcb93747
Opcode Fuzzy Hash: b597888b35b2e63cb806ef268b94ff1a0882a60f9473701b0472f7e32c460fe3
Instruction Fuzzy Hash: 6721D3B1D01358AFDB00EFA4EC89BDDBBB4FB08714F10411AF612A62A0D7B54544DF99

Function 00C309DB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C3071A: CreateFileW.KERNEL32(00000000,00000000,?,00C30A84,?,?,00000000,?,00C30A84,00000000,0000000C), ref: 00C30737

GetLastError.KERNEL32 ref: 00C30AEF
__dosmaperr.LIBCMT ref: 00C30AF6
GetFileType.KERNEL32(00000000), ref: 00C30B02
GetLastError.KERNEL32 ref: 00C30B0C
__dosmaperr.LIBCMT ref: 00C30B15
CloseHandle.KERNEL32(00000000), ref: 00C30B35
CloseHandle.KERNEL32(?), ref: 00C30C7F
GetLastError.KERNEL32 ref: 00C30CB1
__dosmaperr.LIBCMT ref: 00C30CB8

Strings

H, xrefs: 00C30C3D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 44b4759d29cfa755d4e2cb28cb41e885ed27f774932b5c5f0208a180992689ec
Instruction ID: 38ad8b975fa14cdcdc2bb65866d469696cd02642eff0c4039bcca14c70384eae
Opcode Fuzzy Hash: 44b4759d29cfa755d4e2cb28cb41e885ed27f774932b5c5f0208a180992689ec
Instruction Fuzzy Hash: 7AA108329141089FDF19EF68E861BAD7BA0AF06324F24015DF811DB3D2D7319D12DB51

Function 00BF52A7 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF5594: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00C34B76,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00BF55B2

Part of subcall function 00BF5238: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BF525A

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00BF53C4
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00C34BFD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00C34C3E
RegCloseKey.ADVAPI32(?), ref: 00C34C80
_wcslen.LIBCMT ref: 00C34CE7
_wcslen.LIBCMT ref: 00C34CF6

Strings

\Include\, xrefs: 00BF5381
Software\AutoIt v3\AutoIt, xrefs: 00BF53BA
Include, xrefs: 00C34BF4, 00C34C35
\, xrefs: 00C34CFC

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 84afe1ca9489c052a7ec8b0eedc045db83c59d0246154601e774c95f23bffb1f
Instruction ID: e79425a17f0eafff4ca8a69c43d01c1c1fc6c105375e2885849e2b4674e2613e
Opcode Fuzzy Hash: 84afe1ca9489c052a7ec8b0eedc045db83c59d0246154601e774c95f23bffb1f
Instruction Fuzzy Hash: 8D719D715143859BC704EF65EC81EAEBBE8FF98340F90846EF541831B0DB719A49CB92

Function 00BF34D3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BF34DE
LoadCursorW.USER32(00000000,00007F00), ref: 00BF34ED
LoadIconW.USER32(00000063), ref: 00BF3503
LoadIconW.USER32(000000A4), ref: 00BF3515
LoadIconW.USER32(000000A2), ref: 00BF3527
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BF353F
RegisterClassExW.USER32(?), ref: 00BF3590

Part of subcall function 00BF3624: GetSysColorBrush.USER32(0000000F), ref: 00BF3657
Part of subcall function 00BF3624: RegisterClassExW.USER32(00000030), ref: 00BF3681
Part of subcall function 00BF3624: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BF3692
Part of subcall function 00BF3624: InitCommonControlsEx.COMCTL32(?), ref: 00BF36AF
Part of subcall function 00BF3624: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BF36BF
Part of subcall function 00BF3624: LoadIconW.USER32(000000A9), ref: 00BF36D5
Part of subcall function 00BF3624: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BF36E4

Strings

#, xrefs: 00BF3566
0, xrefs: 00BF355F
AutoIt v3, xrefs: 00BF357F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 9707e0273a55b78eb558b3d474e03746547dd81b1b2618f59c9d940793713ad4
Instruction ID: 92b779213bcaeacc926a5fa9ff313e487c47672f37c86accbae2d8fb450c3021
Opcode Fuzzy Hash: 9707e0273a55b78eb558b3d474e03746547dd81b1b2618f59c9d940793713ad4
Instruction Fuzzy Hash: 8E213D70D00398ABDB109FA5EC55FAD7FF8FB08B50F08002AEA05A72B0D7B945448F94

Function 00C70FB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00C71019
inet_addr.WSOCK32(?), ref: 00C71079
gethostbyname.WS2_32(?), ref: 00C71085
IcmpCreateFile.IPHLPAPI ref: 00C71093
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C71123
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C71142
IcmpCloseHandle.IPHLPAPI(?), ref: 00C71216
WSACleanup.WSOCK32 ref: 00C7121C

Strings

Ping, xrefs: 00C710D3

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: ec18e24d639095daad203232a6aa9a34ebfb133a6e20779cce13510672c7a0f9
Instruction ID: 18d8978b9a270c33fe6b1821e9af58e17c5e0d1fe455c7287fb3e655816cf919
Opcode Fuzzy Hash: ec18e24d639095daad203232a6aa9a34ebfb133a6e20779cce13510672c7a0f9
Instruction Fuzzy Hash: 469183716042419FD720DF19C889F2ABBE4BF44318F18C5A9F9699F6A2C731ED85CB81

Function 00BF370F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00BF3709,?,?), ref: 00BF3777
KillTimer.USER32(?,00000001,?,?,?,?,?,00BF3709,?,?), ref: 00BF37A3
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BF37C6
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00BF3709,?,?), ref: 00BF37D1
CreatePopupMenu.USER32 ref: 00BF37E5
PostQuitMessage.USER32(00000000), ref: 00BF3806

Strings

TaskbarCreated, xrefs: 00BF37CC

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: a839c349e34edd057c12e7a0d93d097824b23311686c54d1b1116994db8ce014
Instruction ID: 4585b5a80723548a2173ef9fb94005cb3c16620ba97ed9bac6252fdd938323dc
Opcode Fuzzy Hash: a839c349e34edd057c12e7a0d93d097824b23311686c54d1b1116994db8ce014
Instruction Fuzzy Hash: 0A41B1F121428CBADB143B68DC89F7D3AE9E704B10F044169FB02871A4CAB89F889765

Function 00C290C5 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef59fcc8d00320062cc446cf749f4938e44fecca11bf5206f385afe49dee23d
Instruction ID: b19bf86713799e4f308b24a5429c93d814d68517a161467c3cf58e90cbae7df6
Opcode Fuzzy Hash: bef59fcc8d00320062cc446cf749f4938e44fecca11bf5206f385afe49dee23d
Instruction Fuzzy Hash: A7C1E570D04259AFDF11DFE9E841BADBBB0EF0A310F084059E965A77A2C7309E42DB61

Function 00C0AC3E Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d1r0,2, xrefs: 00C0ACA9
d1b, xrefs: 00C0AD55, 00C0AE8E
d10m0, xrefs: 00C0ACF0
i, xrefs: 00C0B0A3
d0b, xrefs: 00C0AC96, 00C0AD10, 00C0AEA7
d5m0, xrefs: 00C0AE75

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID: d0b$d10m0$d1b$d1r0,2$d5m0$i
API String ID: 0-4285391669
Opcode ID: 5eff6b7c6fed7325d107f6426d341cdc1f43954b6766732ba9c7dd58ce8a1af2
Instruction ID: 7accb634d2c3fdff09dbad0719e72c4b32155f7a7fe5e0bf33825c16ca979a86
Opcode Fuzzy Hash: 5eff6b7c6fed7325d107f6426d341cdc1f43954b6766732ba9c7dd58ce8a1af2
Instruction Fuzzy Hash: 066248B05083459FC728DF15C494AAEBBE1FF89308F10895EE5998B391DB71DA49CF82

Function 00BF35B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BF35E1
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BF3602
ShowWindow.USER32(00000000,?,?,?,?,?,?,00BF3368,?), ref: 00BF3616
ShowWindow.USER32(00000000,?,?,?,?,?,?,00BF3368,?), ref: 00BF361F

Strings

edit, xrefs: 00BF35FC
AutoIt v3, xrefs: 00BF35D9, 00BF35DE, 00BF35DF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: bececec0de2a8b6118d75bc2b504ffe309f1ce0ad6d67137ba90dc3d2879b88b
Instruction ID: faf5c7bc521fd021aa375259b41767ed205780dec7efdf88bca97b3abf7a9adc
Opcode Fuzzy Hash: bececec0de2a8b6118d75bc2b504ffe309f1ce0ad6d67137ba90dc3d2879b88b
Instruction Fuzzy Hash: 73F017706002D47AEB211713AC08F7B2FBDE7C6F10B18002EF905A61B0C6694841EBB4

Function 00BF61A9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00C35287

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BF6299

Strings

AutoIt - , xrefs: 00BF620D
Line %d: , xrefs: 00C35305

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line %d: $AutoIt -
API String ID: 2289894680-4094128768
Opcode ID: 5540c1ee9b1806ada174fe1b010694240d945b70c72653d2a37bd28c97054665
Instruction ID: affa1cb29180d54cce49ef74ab9e0e9756c73248d461c3410d624cc7bbdea52b
Opcode Fuzzy Hash: 5540c1ee9b1806ada174fe1b010694240d945b70c72653d2a37bd28c97054665
Instruction Fuzzy Hash: C6416D71408208AAC711EB60DC45FEF77ECAF55320F04466AFA99930A2EB749649C796

Function 00BF58CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00BF58BE,SwapMouseButtons,00000004,?), ref: 00BF58EF
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00BF58BE,SwapMouseButtons,00000004,?), ref: 00BF5910
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00BF58BE,SwapMouseButtons,00000004,?), ref: 00BF5932

Strings

Control Panel\Mouse, xrefs: 00BF58ED

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 537f20438ad3907656fe4cad19fe3dca3e40f12d41af1caee43e2199982e94a1
Instruction ID: 7172d9b23733764edfcb57509a614e721f66284a8602432ffab648d58e83ebb1
Opcode Fuzzy Hash: 537f20438ad3907656fe4cad19fe3dca3e40f12d41af1caee43e2199982e94a1
Instruction Fuzzy Hash: 7511487551061CFEDB258F64C880ABE77A8EF40760B108499EA02E7210E271AE459764

Function 00BFF6D0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00C448C6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: cde841834b0fb7d42e17d5cbc4abdc7ec10ea5e3baf50c8d24967eea7c8d74c1
Instruction ID: 2521cd78dc3f0a43c46992fc96cd24c29d1341eebbfdb27c62219bbf67e2f875
Opcode Fuzzy Hash: cde841834b0fb7d42e17d5cbc4abdc7ec10ea5e3baf50c8d24967eea7c8d74c1
Instruction Fuzzy Hash: 89C27C75A0020ADFCB24DF98D880BBDB7F1FF09310F2481A9EA15AB291D775AD85DB50

Function 00C00340 Relevance: 5.7, APIs: 3, Instructions: 1236COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C015F2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 71c8154bd9a8fd7115d6b7186baff8e69ade9e34163ff38b523517cd42a56302
Instruction ID: d1b1f1c88ec802c184722e52eefa30d05adee930997209156f8677c09301ae57
Opcode Fuzzy Hash: 71c8154bd9a8fd7115d6b7186baff8e69ade9e34163ff38b523517cd42a56302
Instruction Fuzzy Hash: 93B28D74A08340CFCB24CF19C480B2AB7E1BF99700F29895DE9958B392D771EE85DB52

Function 00C1014B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00C109D8

Part of subcall function 00C13614: RaiseException.KERNEL32(?,?,?,00C109FA,?,00000000,?,?,?,?,?,?,00C109FA,00000000,00CB9758,00000000), ref: 00C13674

__CxxThrowException@8.LIBVCRUNTIME ref: 00C109F5

Strings

Unknown exception, xrefs: 00C10A02

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 62ff42115d759bdb972f5ea4ecf09498bcd546a5ed0fe12c98bd49ddd5976045
Instruction ID: 0e4f36345357b31b6faef47d9ead1270e28ada947604efed8d18aaae292558c4
Opcode Fuzzy Hash: 62ff42115d759bdb972f5ea4ecf09498bcd546a5ed0fe12c98bd49ddd5976045
Instruction Fuzzy Hash: FBF0C23490020CB78F00BAA5EC568DE776C9E03354FB04120B924A6592FBB0EBD6F6D0

Function 00C789B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00C78D52
TerminateProcess.KERNEL32(00000000), ref: 00C78D59
FreeLibrary.KERNEL32(?,?,?,?), ref: 00C78F3A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: ae398e2a0e39109d7643fbba2d0940e324dc50e930de96cc336321650c75297d
Instruction ID: 2fb5d01f61e8bc01afd9798103d54a26d977eed96622ca2470aca35edf4b1114
Opcode Fuzzy Hash: ae398e2a0e39109d7643fbba2d0940e324dc50e930de96cc336321650c75297d
Instruction Fuzzy Hash: E8127D71A083419FC714DF24C484B6ABBE5FF88324F14895DE9998B392CB31ED49CB92

Function 00C79AF3 Relevance: 4.7, APIs: 3, Instructions: 233COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C79B87
_strcat.LIBCMT ref: 00C79BC6
_wcslen.LIBCMT ref: 00C79C14

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$_strcat
String ID:
API String ID: 306214811-0
Opcode ID: 801c485e0cf30e58027410b6e65f343482b5c0daf55732ff9d0580cd9032012f
Instruction ID: 0e746785c68f9c216a2e050f0a6bec624eb57571be94f83e717db5b0dc93d5f2
Opcode Fuzzy Hash: 801c485e0cf30e58027410b6e65f343482b5c0daf55732ff9d0580cd9032012f
Instruction Fuzzy Hash: 69A16B31604505EFCB28DF18D5D19A9BBE1FF56314B60C4ADE81A8F292DB31ED86DB80

Function 00BF2793 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF327E: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BF32AF
Part of subcall function 00BF327E: MapVirtualKeyW.USER32(00000010,00000000), ref: 00BF32B7
Part of subcall function 00BF327E: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BF32C2
Part of subcall function 00BF327E: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BF32CD
Part of subcall function 00BF327E: MapVirtualKeyW.USER32(00000011,00000000), ref: 00BF32D5
Part of subcall function 00BF327E: MapVirtualKeyW.USER32(00000012,00000000), ref: 00BF32DD

Part of subcall function 00BF3205: RegisterWindowMessageW.USER32(00000004,?,00BF2964), ref: 00BF325D

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00BF2A0A
OleInitialize.OLE32 ref: 00BF2A28
CloseHandle.KERNEL32(00000000,00000000), ref: 00C33A0D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 4f746ff6e8be6a15800d6ce57fa495c8382f3f6ae1a46526682fbd1167147fa0
Instruction ID: 769c1b3ad2375c9bcb25c92c459c50da821c43f0ce4dcda351275e8667dcc460
Opcode Fuzzy Hash: 4f746ff6e8be6a15800d6ce57fa495c8382f3f6ae1a46526682fbd1167147fa0
Instruction Fuzzy Hash: A47178B19113048F8B88EF69ED69F2E7BE1FB4830575041AEE109C73A1EBB045469F58

Function 00C0FCAD Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF61A9: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BF6299

KillTimer.USER32(?,00000001,?,?), ref: 00C0FD36
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C0FD45
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C4FE33

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 2f9197ef17771d28f1d059ab8a45dde32c853c535071459fcecc16ba6bebce54
Instruction ID: 7fc72b26f558f58dd2f9244f6e66c0ce5ead84e025cced448336d79f1cda9b0a
Opcode Fuzzy Hash: 2f9197ef17771d28f1d059ab8a45dde32c853c535071459fcecc16ba6bebce54
Instruction Fuzzy Hash: ED31A971904754AFDB32CF24C855BEBBBECAF02304F04049ED5DA97142C3745A86CB51

Function 00C28A2E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,00C2894C,?,00CB9CE8,0000000C), ref: 00C28A84
GetLastError.KERNEL32(?,00C2894C,?,00CB9CE8,0000000C), ref: 00C28A8E
__dosmaperr.LIBCMT ref: 00C28AB9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 479098fbe13bdf5decfc09ad931e30a319deeff1f03cf4b6e721c96deed292c8
Instruction ID: c9265e168c413a1f8fe0f4dda6a37037f0d972c6b14b63f2d8bdd4528363e979
Opcode Fuzzy Hash: 479098fbe13bdf5decfc09ad931e30a319deeff1f03cf4b6e721c96deed292c8
Instruction Fuzzy Hash: B4014932617670AADA246274BC46B7F67494F82B34F29021EF8248B9D3DF708EC57290

Function 00C2970B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,00C297BA,FF8BC369,00000000,00000002,00000000), ref: 00C29744
GetLastError.KERNEL32(?,00C297BA,FF8BC369,00000000,00000002,00000000,?,00C25ED4,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00C16F41), ref: 00C2974E
__dosmaperr.LIBCMT ref: 00C29755

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 199e4be606582d4599a5183afe39e34532f264106fcb4bb9c27f17783ef03648
Instruction ID: 536b3def072108d20f28ca405f8ceca88bedbbea3d905568581c1766c5a03915
Opcode Fuzzy Hash: 199e4be606582d4599a5183afe39e34532f264106fcb4bb9c27f17783ef03648
Instruction Fuzzy Hash: 9A01F032630524ABCB159F99FC05DAE7729DF85730F240259F811971D0E671DD919790

Function 00BFF238 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00BFF27B
DispatchMessageW.USER32(?), ref: 00BFF289
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BFF29F
Sleep.KERNEL32(0000000A), ref: 00BFF2B1
TranslateAcceleratorW.USER32(?,?,?), ref: 00C432D8

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: d8c9f7ef2f8807839a6be48b29f854922b7dd4520bb747005ed899ecb0e7dbfc
Instruction ID: 574064f92774b6364197f3384fed3bd2fc3a0c0c4b9edb7d64a3d77287d3ceb9
Opcode Fuzzy Hash: d8c9f7ef2f8807839a6be48b29f854922b7dd4520bb747005ed899ecb0e7dbfc
Instruction Fuzzy Hash: CBF05E306043899BEB30CBA0CC89FEA73ACEF84310F104929F21A830D0DB709588DB25

Function 00C02B20 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C03006

Strings

CALL, xrefs: 00C02FD6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 7b1bcce203c8c167c73a559d42fe0adeccd2e0a481045d7ab0cdd2697faf8e8c
Instruction ID: 1734a951d2e25051a41b3b3ae4116b784ca493f52922b18ad684a606b049c1e2
Opcode Fuzzy Hash: 7b1bcce203c8c167c73a559d42fe0adeccd2e0a481045d7ab0cdd2697faf8e8c
Instruction Fuzzy Hash: 1922AA706083419FD714DF24C884B2ABBF5BF89314F24895DF4AA8B3A1D771EA85DB42

Function 00C01990 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ba7639a2f825075cf0dae7f634bfaf2c0a6aea88382ece4c88e59931123a1b
Instruction ID: b1b19b4ec5f1b7a6e980286420fba0d5e745dcefbcb7506f10b09e095d9d048f
Opcode Fuzzy Hash: a1ba7639a2f825075cf0dae7f634bfaf2c0a6aea88382ece4c88e59931123a1b
Instruction Fuzzy Hash: BF32E370A00215EFCB20DF54C881BAEB7B4FF06314F188559F965AB291DB71EE84EB52

Function 00BF3A95 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00C3413B

Part of subcall function 00BF5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BF55D1,?,?,00C34B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00BF5871

Part of subcall function 00BF3A57: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00BF3A76

Strings

X, xrefs: 00C34109

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: b6f109144af41a896f5609568765ce119b9fa2ff952a994ba3f6944e66671687
Instruction ID: 2a5f2013a8fe46c05efea0150619012eed2e46b8de7eb193f4911a39466886ce
Opcode Fuzzy Hash: b6f109144af41a896f5609568765ce119b9fa2ff952a994ba3f6944e66671687
Instruction Fuzzy Hash: 22218171A0025C9BCF15DF98C845BEE7BF8AF49714F008059EA45B7281DBB49A8D8F61

Function 00BF396B Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BF3A3C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: ed872db6e3bf87d7028d7980d3a00f8e5d674cfc5e5266af835d2b52df167ef6
Instruction ID: 6de77e1099c9a97588801baa69f628bef47a52f4971e090f7423730ea9d8edae
Opcode Fuzzy Hash: ed872db6e3bf87d7028d7980d3a00f8e5d674cfc5e5266af835d2b52df167ef6
Instruction Fuzzy Hash: D23195706047058FD320DF25D884BABBBF8FB49714F00096EEADA87251D7B5AA48CB52

Function 00BF331B Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00BF333D

Part of subcall function 00BF32E6: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00BF32FB
Part of subcall function 00BF32E6: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00BF3312

Part of subcall function 00BF338B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00BF3368,?), ref: 00BF33BB
Part of subcall function 00BF338B: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00BF3368,?), ref: 00BF33CE
Part of subcall function 00BF338B: GetFullPathNameW.KERNEL32(00007FFF,?,?,00CC2418,00CC2400,?,?,?,?,?,?,00BF3368,?), ref: 00BF343A
Part of subcall function 00BF338B: SetCurrentDirectoryW.KERNEL32(?,00000001,00CC2418,?,?,?,?,?,?,?,00BF3368,?), ref: 00BF34BB

SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 00BF3377

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
String ID:
API String ID: 1550534281-0
Opcode ID: 02ad77cf6fb62a977b7161a8791c2c065daa03ea2990735dde8e801d661c04eb
Instruction ID: f18810158a8562c496bb25a0a458f0129a74732e35b829fd2fb0961a3b184483
Opcode Fuzzy Hash: 02ad77cf6fb62a977b7161a8791c2c065daa03ea2990735dde8e801d661c04eb
Instruction Fuzzy Hash: C2F054725543849FD701AF60FC0AF7C37D8A745B09F084866FA05460F2CBBA41949B44

Function 00C0FFE0 Relevance: 2.6, APIs: 2, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00C1007D
Sleep.KERNEL32 ref: 00C1008F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseHandleSleep
String ID:
API String ID: 252777609-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 28c5ad41f5e3e8f734168e921eaf76e08fa58e3519efcce1cf93169f91ae2d94
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6831D574A00105DFC718DF59D480AA9FBA5FB4A300B3486A5E419CB252D7B2EEC1EBC0

Function 00BFCAB0 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BFCEEE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 24ababb91de152d465b308bab48684e9edd0b188fad56d6caa502195fe715cd9
Instruction ID: 27bef3c54b2578186432a9029c12061ecb9b304813fe18e98aa53d67169ef180
Opcode Fuzzy Hash: 24ababb91de152d465b308bab48684e9edd0b188fad56d6caa502195fe715cd9
Instruction Fuzzy Hash: 06328E74A0024D9FDB10CF58C984ABEBBF5FF44314F1980A9EA55AB251C734AE89DB90

Function 00C77AF9 Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 1f35fb924956abb33a860d183bf60950f066cfe845d7abf6d566263fa96deb7e
Instruction ID: e4305cae18013111235249042e8fbd56a6f1ecd0f60a8a119681d8488d4aa877
Opcode Fuzzy Hash: 1f35fb924956abb33a860d183bf60950f066cfe845d7abf6d566263fa96deb7e
Instruction Fuzzy Hash: 58D12C75A04209EFCB14EF98C481DBDBBB5FF58310F148199E919AB291DB31AE85CF90

Function 00C1F106 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce4ecdcb029de386f2b4d14b774d4c41ddfc7691580c282a2644b7837ade750
Instruction ID: d97a63842370467db669e19587ddc312138e93286468c3b292de672cce68f859
Opcode Fuzzy Hash: 3ce4ecdcb029de386f2b4d14b774d4c41ddfc7691580c282a2644b7837ade750
Instruction Fuzzy Hash: 1051E935A00118AFDB11DF68C840BE97BA1EF87364F19816CE8199B391D731EE83EB50

Function 00C5FCB5 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C5FCCE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 1c970a65dc6bdb1c6197860bc7c594a9015640766d8f357d224fb3d3556fa8e0
Instruction ID: 5e286107b32de517c5bc0250fcd9013cf717f8460d357c1baa52762020342f57
Opcode Fuzzy Hash: 1c970a65dc6bdb1c6197860bc7c594a9015640766d8f357d224fb3d3556fa8e0
Instruction Fuzzy Hash: 4E41B67A500209AFDB15EF68C8819AEB7F8EF44315B20453EE91697251EB70DF89CB50

Function 00BF6679 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF663E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BF668B,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF664A
Part of subcall function 00BF663E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BF665C
Part of subcall function 00BF663E: FreeLibrary.KERNEL32(00000000,?,?,00BF668B,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF666E

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF66AB

Part of subcall function 00BF6607: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00C35657,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF6610
Part of subcall function 00BF6607: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BF6622
Part of subcall function 00BF6607: FreeLibrary.KERNEL32(00000000,?,?,00C35657,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF6635

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: b0457b6c86f3ec419f4e8c82a6b07cd38e77de22aa8bec6a047b1aa4ced9bb1b
Instruction ID: 554e79979de9428cc7aaabb9b9727dbdbadc54b2b53cd17d201bdbfda93922a3
Opcode Fuzzy Hash: b0457b6c86f3ec419f4e8c82a6b07cd38e77de22aa8bec6a047b1aa4ced9bb1b
Instruction Fuzzy Hash: 2611C172600209BACB14BB24C842BFD7BE59F50714F20486EFA53E71C2EE719A09EB54

Function 00C28782 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00C287C0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: d7ef92f44fff1e3159db7ff72dc88b72e26a82aeecce791fa7d4f6ef2c8c7bc3
Instruction ID: 7b8f2c2d7c7577b311ae581f1ceccb67f7880e24385ae5d9a4fcaa6ecd4bfe17
Opcode Fuzzy Hash: d7ef92f44fff1e3159db7ff72dc88b72e26a82aeecce791fa7d4f6ef2c8c7bc3
Instruction Fuzzy Hash: A31118B690410AAFCB05DF58E945A9E7BF4EF48310F154069F809AB311DA31EA258BA5

Function 00C25373 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C24FF0: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,00C2319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00C25031

_free.LIBCMT ref: 00C253DF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction ID: d927f214e0cddcd200a6b561af89080bcc155b603cbbfd1b5c48b3e4b01dd339
Opcode Fuzzy Hash: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction Fuzzy Hash: F00149B62003546BE331CF69E88195AFBEDEB85370F65051DE594836C0EB70A905C774

Function 00C1E972 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction ID: 98182e3be001c44348086327ebcc6c7237e540bfaad2d0904d3a4595b74fbe0d
Opcode Fuzzy Hash: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction Fuzzy Hash: 90F0283250163057D6313A6BAC05BDA33989F43331F100B26FD22D75D1EB74E982B6D2

Function 00C6F94A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00C6F987

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 20777bde6f7c47b2b8c911f7ac0c200abd1651efb6392f4ce6baa24ace216c64
Instruction ID: 4d1c3d33c73176eb0abcfabceb9379ed13393c223ac3c351aea6882d2ddcbcba
Opcode Fuzzy Hash: 20777bde6f7c47b2b8c911f7ac0c200abd1651efb6392f4ce6baa24ace216c64
Instruction Fuzzy Hash: 06F08C72600208BFCB10EBA5DC46EAFB7B8EF4A720F104059F6059B260DA74EE81D760

Function 00C24FF0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,00C2319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00C25031

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cd630fed2f79b75ac29b4fbeca7c9637916a035ca4a155099ca521a4a07614e9
Instruction ID: 1b0d163f56ea7d33b77a5d803320b07706de49a9284bca7e2abb691e54e6b19e
Opcode Fuzzy Hash: cd630fed2f79b75ac29b4fbeca7c9637916a035ca4a155099ca521a4a07614e9
Instruction Fuzzy Hash: B4F0E932510E30A7DB312A27FC45F5B3748AF827F0F148011F825D74A0DA70D90166E0

Function 00C23B93 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00C16A79,?,0000015D,?,?,?,?,00C185B0,000000FF,00000000,?,?), ref: 00C23BC5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8f06d304d59f728a90f3c471137fc4911d4f03c08993b0fdfda968d626b55d42
Instruction ID: 38776b0060dfac8042f62b2d2156a67b447e0f43e8b6fbd8cb674a7c3465b973
Opcode Fuzzy Hash: 8f06d304d59f728a90f3c471137fc4911d4f03c08993b0fdfda968d626b55d42
Instruction Fuzzy Hash: B5E0E5352006B4A7DA223E72BC01F9A364C9F427A0F1401A0FC25968A0CF38CF42A2E0

Function 00BF66E7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c66d8321e2064d7421193ee2b7afd90abb45521cfd9cf491413e35b6499c38
Instruction ID: 70922c8c7c6ae3bcba47d6bee26bc1075961afb405d9e52665c39ae7e241d205
Opcode Fuzzy Hash: d0c66d8321e2064d7421193ee2b7afd90abb45521cfd9cf491413e35b6499c38
Instruction Fuzzy Hash: 46F015B1505702DFCB349F64D8A4866BBF4AF14329324897EEAD687610C731A884EF50

Function 00C46AD5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00C46AE0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a089bd8a09d8d39003f8f1db9ac6c31cc911f7604fd3e3c2044717a60815160d
Instruction ID: 7b0fe7f3fae8a590ba8146a665a33c825ec119244d288e6aad03994b4bbaad9c
Opcode Fuzzy Hash: a089bd8a09d8d39003f8f1db9ac6c31cc911f7604fd3e3c2044717a60815160d
Instruction Fuzzy Hash: 0CF0E5B1B04204AAD7209B6598057AAF7E8BB02314F14851ED8E5821C1C7B644D4E762

Function 00BF684A Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BF6868

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction ID: d3cb4e7d4671a11455880088eeaefa79206c1383e96bae2abe1b6d993f02e5ab
Opcode Fuzzy Hash: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction Fuzzy Hash: 23F0F87551020DFFDF05DF90C941EAEBBB9FB05318F208489F9159A151C336EA61ABA1

Function 00BF3907 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00BF3963

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 3573498d7ee526a8ec80c58a9e8c7b4a3d7c353c4c23cd806dc950d352cbf37f
Instruction ID: cd8d94a645f3d5f81beca4b506be30226ccc4033c679ac80189c605f6a735991
Opcode Fuzzy Hash: 3573498d7ee526a8ec80c58a9e8c7b4a3d7c353c4c23cd806dc950d352cbf37f
Instruction Fuzzy Hash: FBF012709143589FE7529F24DC45B997BFCA701708F0400A5A64596192D7749788CB51

Function 00BF3A57 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00BF3A76

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 847783604c2108ad50c8a6e8d4b946fcfd2612a1c29d9fbdc33835d41e4799ad
Instruction ID: 9eff55d9846de33196d131e92ea90e81bc170d7c2476d21fae8bdd9b5399a2d1
Opcode Fuzzy Hash: 847783604c2108ad50c8a6e8d4b946fcfd2612a1c29d9fbdc33835d41e4799ad
Instruction Fuzzy Hash: ADE0C272A002285BCB20A2589C06FEE77EDDFC87A0F0440B1FD09D7258D960ED809690

Function 00C3071A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00C30A84,?,?,00000000,?,00C30A84,00000000,0000000C), ref: 00C30737

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 725a774dad7b5aa740b441e6fa8f99e5310bbc3ae427ace371a55059675bc192
Instruction ID: b152387734b6c1c90aa432763186ad66886709c61145b240abd0f07124b83a19
Opcode Fuzzy Hash: 725a774dad7b5aa740b441e6fa8f99e5310bbc3ae427ace371a55059675bc192
Instruction Fuzzy Hash: B4D06C3200010DBBDF028F84DD46EDE3BAAFB48714F014000BE1896060C732E821AB94

Function 00C5EAB0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C5D840), ref: 00C5EAB1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 34bd41c76336ce4b4b28d3a0950b1431652386261ec07bfa11c3cf55452cb9f0
Instruction ID: 621ccd17747dec7537dce55b50cbcc9fcaa6e00bbdd16c37696cd1e2a250d147
Opcode Fuzzy Hash: 34bd41c76336ce4b4b28d3a0950b1431652386261ec07bfa11c3cf55452cb9f0
Instruction Fuzzy Hash: 9DB0923800060005AD2C0A385A09A993B007862BB67DC1BC0F87E850E1C3398E8FBA58

Function 00C6664C Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00C5DC54: FindFirstFileW.KERNEL32(?,?), ref: 00C5DCCB
Part of subcall function 00C5DC54: DeleteFileW.KERNEL32(?,?,?,?), ref: 00C5DD1B
Part of subcall function 00C5DC54: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00C5DD2C
Part of subcall function 00C5DC54: FindClose.KERNEL32(00000000), ref: 00C5DD43

GetLastError.KERNEL32 ref: 00C6666E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: ff6a894a217dcefee864b4da87f8fcbc26edec814bfd31f5e94438a8124b6344
Instruction ID: e97e709767bb3ed46876e5c07aeba5fc9ade6286dfbe34c4815c1893ebc76780
Opcode Fuzzy Hash: ff6a894a217dcefee864b4da87f8fcbc26edec814bfd31f5e94438a8124b6344
Instruction Fuzzy Hash: 2DF082352002045FCB14EF58D455B7EB7E5AF84720F048489F9068B362CB70FC05CB94

Non-executed Functions

Function 00C51B4D Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00C52010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C5205A
Part of subcall function 00C52010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C52087
Part of subcall function 00C52010: GetLastError.KERNEL32 ref: 00C52097

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00C51BD2
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00C51BF4
CloseHandle.KERNEL32(?), ref: 00C51C05
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C51C1D
GetProcessWindowStation.USER32 ref: 00C51C36
SetProcessWindowStation.USER32(00000000), ref: 00C51C40
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C51C5C

Part of subcall function 00C51A0B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C51B48), ref: 00C51A20
Part of subcall function 00C51A0B: CloseHandle.KERNEL32(?,?,00C51B48), ref: 00C51A35

Strings

, xrefs: 00C51BA6
winsta0, xrefs: 00C51C18
default, xrefs: 00C51C57

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: b8c658fea8c6cfeb12292378e7f4af80709469205639e8da7ea72322fbb2a794
Instruction ID: c046bea2011aadd4793bfca0e5fefd587f8e131b977efe21f16f83b58cfe1bf1
Opcode Fuzzy Hash: b8c658fea8c6cfeb12292378e7f4af80709469205639e8da7ea72322fbb2a794
Instruction Fuzzy Hash: 04818F75900209AFDF119FA4DC89FEE7BB8FF04305F184029FD25A61A0D7758A89DB68

Function 00C514AE Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C51A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C51A60
Part of subcall function 00C51A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A6C
Part of subcall function 00C51A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A7B
Part of subcall function 00C51A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A82
Part of subcall function 00C51A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C51A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C51518
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C5154C
GetLengthSid.ADVAPI32(?), ref: 00C51563
GetAce.ADVAPI32(?,00000000,?), ref: 00C5159D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C515B9
GetLengthSid.ADVAPI32(?), ref: 00C515D0
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00C515D8
HeapAlloc.KERNEL32(00000000), ref: 00C515DF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C51600
CopySid.ADVAPI32(00000000), ref: 00C51607
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C51636
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C51658
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C5166A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C51691
HeapFree.KERNEL32(00000000), ref: 00C51698
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C516A1
HeapFree.KERNEL32(00000000), ref: 00C516A8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C516B1
HeapFree.KERNEL32(00000000), ref: 00C516B8
GetProcessHeap.KERNEL32(00000000,?), ref: 00C516C4
HeapFree.KERNEL32(00000000), ref: 00C516CB

Part of subcall function 00C51ADF: GetProcessHeap.KERNEL32(00000008,00C514FD,?,00000000,?,00C514FD,?), ref: 00C51AED
Part of subcall function 00C51ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00C514FD,?), ref: 00C51AF4
Part of subcall function 00C51ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00C514FD,?), ref: 00C51B03

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1344366a7b5d87df8e54891fcff061e94075fdb9a83ccfbac3cb5534778dd8ea
Instruction ID: 2794cfa763d2f623aa70e667499e9eb4f0b9acaeed87610a060f6404b50949ca
Opcode Fuzzy Hash: 1344366a7b5d87df8e54891fcff061e94075fdb9a83ccfbac3cb5534778dd8ea
Instruction Fuzzy Hash: 22715EB9900209ABDF10DFA5DC48FAEBBB8FF04351F184515FD26A7190DB319A49CB68

Function 00C6F55C Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C8DCD0), ref: 00C6F586
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C6F594
GetClipboardData.USER32(0000000D), ref: 00C6F5A0
CloseClipboard.USER32 ref: 00C6F5AC
GlobalLock.KERNEL32(00000000), ref: 00C6F5E4
CloseClipboard.USER32 ref: 00C6F5EE
GlobalUnlock.KERNEL32(00000000), ref: 00C6F619
IsClipboardFormatAvailable.USER32(00000001), ref: 00C6F626
GetClipboardData.USER32(00000001), ref: 00C6F62E
GlobalLock.KERNEL32(00000000), ref: 00C6F63F
GlobalUnlock.KERNEL32(00000000), ref: 00C6F67F
IsClipboardFormatAvailable.USER32(0000000F), ref: 00C6F695
GetClipboardData.USER32(0000000F), ref: 00C6F6A1
GlobalLock.KERNEL32(00000000), ref: 00C6F6B2
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00C6F6D4
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C6F6F1
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C6F72F
GlobalUnlock.KERNEL32(00000000), ref: 00C6F750
CountClipboardFormats.USER32 ref: 00C6F771
CloseClipboard.USER32 ref: 00C6F7B6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: f559293884196e7cfed6a39c75faa7d57fb374df8ed1b539fa771539d6909b20
Instruction ID: 04ad0699424bc42a25939e210914d7743f1cd978d863bb8dc56f2f7c4a3f5c3d
Opcode Fuzzy Hash: f559293884196e7cfed6a39c75faa7d57fb374df8ed1b539fa771539d6909b20
Instruction Fuzzy Hash: 0961DF35204205AFD310EF24E885F2AB7E4AF84314F1444ADF956C72E2DB31EE4ACB62

Function 00C673D4 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C67403
FindClose.KERNEL32(00000000), ref: 00C67457
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C67493
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C674BA

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

FileTimeToSystemTime.KERNEL32(?,?), ref: 00C674F7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C67524

Strings

%02d, xrefs: 00C67645, 00C6764F, 00C6769F, 00C676EF, 00C6773F, 00C6778F
%4d%02d%02d%02d%02d%02d, xrefs: 00C675AF
%4d, xrefs: 00C675F6
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00C67577
%03d, xrefs: 00C677E7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 27561064b299832db6dbbe38f922765da49a4e966895ba4d8700e3c709e85ae3
Instruction ID: 06575e3a49b67b5c4886fec2891ee29d60d60f5ba6cf36c689ecfb3b5e698cc0
Opcode Fuzzy Hash: 27561064b299832db6dbbe38f922765da49a4e966895ba4d8700e3c709e85ae3
Instruction Fuzzy Hash: 4BD15E72508308AEC710EB64C885EBFB7ECAF88704F44495DF695D7192EB74DA48CB62

Function 00C6A087 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00C6A0A8
GetFileAttributesW.KERNEL32(?), ref: 00C6A0E6
SetFileAttributesW.KERNEL32(?,?), ref: 00C6A100
FindNextFileW.KERNEL32(00000000,?), ref: 00C6A118
FindClose.KERNEL32(00000000), ref: 00C6A123
FindFirstFileW.KERNEL32(*.*,?), ref: 00C6A13F
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6A18F
SetCurrentDirectoryW.KERNEL32(00CB7B94), ref: 00C6A1AD
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C6A1B7
FindClose.KERNEL32(00000000), ref: 00C6A1C4
FindClose.KERNEL32(00000000), ref: 00C6A1D4

Strings

*.*, xrefs: 00C6A13A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 4b5d65d589b465b55b27fd3fdfe81b114356696f0eef0a9b57ec9f39519e73cb
Instruction ID: 784e8d11831243c8843772f8b0928c1a3eef22dd1a4efb0fe3a59e593887036e
Opcode Fuzzy Hash: 4b5d65d589b465b55b27fd3fdfe81b114356696f0eef0a9b57ec9f39519e73cb
Instruction Fuzzy Hash: B431B532600219ABDB24AFB4DC89BDE77AC9F46360F100165E826F21D0EB74DE859F65

Function 00C64763 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C64785
_wcslen.LIBCMT ref: 00C647B2
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C647E2
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C64803
RemoveDirectoryW.KERNEL32(?), ref: 00C64813
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C6489A
CloseHandle.KERNEL32(00000000), ref: 00C648A5
CloseHandle.KERNEL32(00000000), ref: 00C648B0

Strings

\, xrefs: 00C647BC
:, xrefs: 00C647C7
\??\%s, xrefs: 00C647A0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 87366bdb583eed73f2d48073180ee3807b1d33a2f905b7ee17cb96d5cbb98b0a
Instruction ID: 69e1e18abbdfc4fc20450b45a04d07c604d2635a0c8a283f2beb5554caeab9ec
Opcode Fuzzy Hash: 87366bdb583eed73f2d48073180ee3807b1d33a2f905b7ee17cb96d5cbb98b0a
Instruction Fuzzy Hash: D031907150024AAADB209BA0DC89FEF37BCEF89751F1041B6F51AD20A0E7709B84DB64

Function 00C6A1E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00C6A203
FindNextFileW.KERNEL32(00000000,?), ref: 00C6A25E
FindClose.KERNEL32(00000000), ref: 00C6A269
FindFirstFileW.KERNEL32(*.*,?), ref: 00C6A285
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6A2D5
SetCurrentDirectoryW.KERNEL32(00CB7B94), ref: 00C6A2F3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C6A2FD
FindClose.KERNEL32(00000000), ref: 00C6A30A
FindClose.KERNEL32(00000000), ref: 00C6A31A

Part of subcall function 00C5E399: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C5E3B4

Strings

*.*, xrefs: 00C6A280

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 4914006c9e4adcb7c0f1724a5d3a8190a60fdc75ff52f355f36c0ac6c8cd7517
Instruction ID: a06b8e304b8120a2973cc438d06fd7cc2b77c4f4aeb4350a70bc8783a9768ee4
Opcode Fuzzy Hash: 4914006c9e4adcb7c0f1724a5d3a8190a60fdc75ff52f355f36c0ac6c8cd7517
Instruction Fuzzy Hash: 8A31123154021AABCB20AFA5DC89FDE77ACAF45324F1041A1E825B31E0DB31DF859F29

Function 00C7C8A4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C7D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7C10E,?,?), ref: 00C7D415
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D451
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4C8
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C7C99E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00C7CA09
RegCloseKey.ADVAPI32(00000000), ref: 00C7CA2D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C7CA8C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C7CB47
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C7CBB4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C7CC49
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00C7CC9A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C7CD43
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C7CDE2
RegCloseKey.ADVAPI32(00000000), ref: 00C7CDEF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 72d3ccad072185d2f6f3864f2f6b9010bf79ed31a6f852c71744f7620cdd0b27
Instruction ID: d3f8809a9af093cec7feeaf0e97cbad16d4bb7197d736569d3d7c4ce88db5662
Opcode Fuzzy Hash: 72d3ccad072185d2f6f3864f2f6b9010bf79ed31a6f852c71744f7620cdd0b27
Instruction Fuzzy Hash: 8B024A71604205AFC714DF28C8D5E2ABBE5EF49314F18C4ADE85ACB2A2DB31ED46CB51

Function 00C5D921 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BF55D1,?,?,00C34B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00BF5871

Part of subcall function 00C5EAB0: GetFileAttributesW.KERNEL32(?,00C5D840), ref: 00C5EAB1

FindFirstFileW.KERNEL32(?,?), ref: 00C5D9CD
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00C5DA88
MoveFileW.KERNEL32(?,?), ref: 00C5DA9B
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C5DAB8
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C5DAE2

Part of subcall function 00C5DB47: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00C5DAC7,?,?), ref: 00C5DB5D

FindClose.KERNEL32(00000000,?,?,?), ref: 00C5DAFE
FindClose.KERNEL32(00000000), ref: 00C5DB0F

Strings

\*.*, xrefs: 00C5D978, 00C5D981, 00C5D996

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 85a2cd04f3628f07dcc044e81741bdc858bd96a7ab1cc0a81b332a547a6bafd9
Instruction ID: cd2b17c2f3a80d33b48fb8e0a9941f9cd4a4a4cfc92d56b70bd0657165831dab
Opcode Fuzzy Hash: 85a2cd04f3628f07dcc044e81741bdc858bd96a7ab1cc0a81b332a547a6bafd9
Instruction Fuzzy Hash: 6F61393580120DABCF15EBA0D992EFDB7B5AF14301F2040A5E902B7192EB315F4DDB65

Function 00C6F7C7 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C6F7EE
EmptyClipboard.USER32 ref: 00C6F7F4
GlobalAlloc.KERNEL32(00000002,?), ref: 00C6F809
CloseClipboard.USER32 ref: 00C6F900

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 48db109673e31eb18acde2f9dae796bdc3f111ea2966bd22d9bef1dbce5c1916
Instruction ID: ba3086078cb3f8ebef819667c7bad1482fc32a341251b96775600c424ff8f817
Opcode Fuzzy Hash: 48db109673e31eb18acde2f9dae796bdc3f111ea2966bd22d9bef1dbce5c1916
Instruction Fuzzy Hash: DE418D31604616AFD720DF15E889F29BBE4EF45319F14C4ADE42A8B6A2C735ED42CB90

Function 00C5F20D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C52010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C5205A
Part of subcall function 00C52010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C52087
Part of subcall function 00C52010: GetLastError.KERNEL32 ref: 00C52097

ExitWindowsEx.USER32(?,00000000), ref: 00C5F249

Strings

, xrefs: 00C5F237
SeShutdownPrivilege, xrefs: 00C5F219
, xrefs: 00C5F273
@, xrefs: 00C5F23C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 81b4c1b7c8282d0988c9d115b9d99e70815a6fc4f4c473459e11c4d1f26ea5e4
Instruction ID: 731f39533d587fcda84555852a47017bd4b5bb2906464d69dc6553946ca47561
Opcode Fuzzy Hash: 81b4c1b7c8282d0988c9d115b9d99e70815a6fc4f4c473459e11c4d1f26ea5e4
Instruction Fuzzy Hash: E9014EBE6113146BEB1C22B89CC9FBF735C9B08342F140535FD13E20D1D5604D899358

Function 00C2BCD2 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C2BD54
_free.LIBCMT ref: 00C2BD78
_free.LIBCMT ref: 00C2BEFF
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C946D0), ref: 00C2BF11
WideCharToMultiByte.KERNEL32(00000000,00000000,00CC221C,000000FF,00000000,0000003F,00000000,?,?), ref: 00C2BF89
WideCharToMultiByte.KERNEL32(00000000,00000000,00CC2270,000000FF,?,0000003F,00000000,?), ref: 00C2BFB6
_free.LIBCMT ref: 00C2C0CB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: c58749582e9e56b0d324fc6ecfbff29f65186f5529afbcf9afbc54dba2880919
Instruction ID: 0532cdc5f8accccfd9115d90c8a1615898de0212f04ada9a39384555ec09d741
Opcode Fuzzy Hash: c58749582e9e56b0d324fc6ecfbff29f65186f5529afbcf9afbc54dba2880919
Instruction Fuzzy Hash: 27C13935900225AFDB24DF78EC41BEEBBB8EF41320F14419AE5A19B691E7309F41DB50

Function 00C63A0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00C356C2,?,?,00000000,00000000), ref: 00C63A1E
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00C356C2,?,?,00000000,00000000), ref: 00C63A35
LoadResource.KERNEL32(?,00000000,?,?,00C356C2,?,?,00000000,00000000,?,?,?,?,?,?,00BF66CE), ref: 00C63A45
SizeofResource.KERNEL32(?,00000000,?,?,00C356C2,?,?,00000000,00000000,?,?,?,?,?,?,00BF66CE), ref: 00C63A56
LockResource.KERNEL32(00C356C2,?,?,00C356C2,?,?,00000000,00000000,?,?,?,?,?,?,00BF66CE,?), ref: 00C63A65

Strings

SCRIPT, xrefs: 00C63A2B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 6d7708dbcd98c7dab435707615506b7df78896ffc5b7b7eba7e59de5fb7bbade
Instruction ID: 1cb94de8d706f07f3b7611e80064776a09fb4a7d1c1ca7064e8f46f748e8a716
Opcode Fuzzy Hash: 6d7708dbcd98c7dab435707615506b7df78896ffc5b7b7eba7e59de5fb7bbade
Instruction Fuzzy Hash: DC115770200701AFE7258BA5DC88F2B7BB9EFC5B50F14426DB812962A0DB71ED01EB20

Function 00C520AA Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C51900: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C51916
Part of subcall function 00C51900: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C51922
Part of subcall function 00C51900: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C51931
Part of subcall function 00C51900: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C51938
Part of subcall function 00C51900: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C5194E

GetLengthSid.ADVAPI32(?,00000000,00C51C81), ref: 00C520FB
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C52107
HeapAlloc.KERNEL32(00000000), ref: 00C5210E
CopySid.ADVAPI32(00000000,00000000,?), ref: 00C52127
GetProcessHeap.KERNEL32(00000000,00000000,00C51C81), ref: 00C5213B
HeapFree.KERNEL32(00000000), ref: 00C52142

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: fd05d11d5e731d9247440f700ee70deccc67960d0600b66f0f9f2703002fe38c
Instruction ID: d28aa51eb3d9e0a6bb9e976eb0b2b2afce52055445b06fb9751a84372b2e270c
Opcode Fuzzy Hash: fd05d11d5e731d9247440f700ee70deccc67960d0600b66f0f9f2703002fe38c
Instruction Fuzzy Hash: 9E110075501604FFDB149FA4CC08FAF7BB9EF52366F144018E942931A0C7319E88CB68

Function 00C6A570 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00C6A5BD
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00C6A6D0

Part of subcall function 00C642B9: GetInputState.USER32 ref: 00C64310
Part of subcall function 00C642B9: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C643AB

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00C6A5ED
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00C6A6BA

Strings

*.*, xrefs: 00C6A5A2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: dd1cc949ccf988168d4278bc1c88aa6a1d5f66981da09ec55848abf206323402
Instruction ID: 53c9ad6e9f568fa715527e375d3b1e3ea7938e1a439c306821745d0a29223c42
Opcode Fuzzy Hash: dd1cc949ccf988168d4278bc1c88aa6a1d5f66981da09ec55848abf206323402
Instruction Fuzzy Hash: 4A411F7590020AAFCF24EF64C989AEE7BB4EF05310F144155F916B3191EB319E54DF61

Function 00BF22AD Relevance: 7.8, APIs: 5, Instructions: 308COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?), ref: 00BF233E
GetSysColor.USER32(0000000F), ref: 00BF2421
SetBkColor.GDI32(?,00000000), ref: 00BF2434

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Color$Proc
String ID:
API String ID: 929743424-0
Opcode ID: b03771ad48b39c212fd34e681d29080752d8b442ee8141d778d159a373525e17
Instruction ID: e25897c6dc1dc414b8fc19e9d277eab8bc31692c7009d153a8d6be129854c6d2
Opcode Fuzzy Hash: b03771ad48b39c212fd34e681d29080752d8b442ee8141d778d159a373525e17
Instruction Fuzzy Hash: 618102F011444CBEE629672C8DA9EBF25DEDB42304F15018AF702C7695C9698F4A937F

Function 00C72263 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C73AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C73AD7
Part of subcall function 00C73AAB: _wcslen.LIBCMT ref: 00C73AF8

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00C722BA
WSAGetLastError.WSOCK32 ref: 00C722E1
bind.WSOCK32(00000000,?,00000010), ref: 00C72338
WSAGetLastError.WSOCK32 ref: 00C72343
closesocket.WSOCK32(00000000), ref: 00C72372

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 7924a05b7f07bb5dc79594c501d4d9d68de78c1ee5b4755333d124d24d44e978
Instruction ID: e782f157bd3bb9fba8dce92dfe32161d981ccd7717c252932ffd6b39e6a6ef79
Opcode Fuzzy Hash: 7924a05b7f07bb5dc79594c501d4d9d68de78c1ee5b4755333d124d24d44e978
Instruction Fuzzy Hash: 73519371A00204AFE710AF24C886F3AB7E5AB45758F48C098F95A9B3D3C674ED41CBA1

Function 00C826DD Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C8275C
IsWindowEnabled.USER32 ref: 00C8276A
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00C82777
IsIconic.USER32 ref: 00C82785
IsZoomed.USER32 ref: 00C82793

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: af09c49dfd7d461dad7b6c883174137d08517e35b3b507556b6e0dee8d02a79a
Instruction ID: 9d4882c89ebced5976341ff72d3bca6973f760098a50132d7be754eeee6b018d
Opcode Fuzzy Hash: af09c49dfd7d461dad7b6c883174137d08517e35b3b507556b6e0dee8d02a79a
Instruction Fuzzy Hash: D121F7317002159FD711AF27C848B1A7BE5EF85318F58806DE85ACB351DB71ED42CB98

Function 00C6D889 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00C6D8CE
GetLastError.KERNEL32(?,00000000), ref: 00C6D92F
SetEvent.KERNEL32(?,?,00000000), ref: 00C6D943

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 658d282834c9f801f4ee8b1875c3ff7bd4829e433ee1b251e4d06c026e8507c4
Instruction ID: 91d8adf1277c3fe8d3c77e46464620b633e7408b114e13dbbc8b8f508a82ddda
Opcode Fuzzy Hash: 658d282834c9f801f4ee8b1875c3ff7bd4829e433ee1b251e4d06c026e8507c4
Instruction Fuzzy Hash: EF219D71A00705ABE7309FA6D888BAAB7F8EF41314F10442EE657D2191EB70EE45DB94

Function 00C5E472 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00C346AC), ref: 00C5E482
GetFileAttributesW.KERNEL32(?), ref: 00C5E491
FindFirstFileW.KERNEL32(?,?), ref: 00C5E4A2
FindClose.KERNEL32(00000000), ref: 00C5E4AE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: ec6feabd6b6315639cbe12f49765a47d7e7b5be8bf285414e51d113eae27ff59
Instruction ID: 93749c6c85e23a5c8978e95078bdcc0b149878791892225127b9984a27a98e81
Opcode Fuzzy Hash: ec6feabd6b6315639cbe12f49765a47d7e7b5be8bf285414e51d113eae27ff59
Instruction Fuzzy Hash: 5EF0A03081091067D61477B8AC0D9AE77ADAE02336B504701FC36C20F0D7789E99879D

Function 00C4E5F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C4E5F8

Strings

X64, xrefs: 00C4E680
%.3d, xrefs: 00C4E603

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 606a9725db3d9f51af6bb27489b7c20d51da33bcb7941b5b88c8d4fb0b58808b
Instruction ID: 7bb281e88c84c1238076e8433a8b5d100d98c67229f0a50f0148e6fedf1e2edc
Opcode Fuzzy Hash: 606a9725db3d9f51af6bb27489b7c20d51da33bcb7941b5b88c8d4fb0b58808b
Instruction Fuzzy Hash: 4FD012B1C0810CE6CBD096D19C48DFD737CBB18700F164866F90691040E6209948E725

Function 00C22992 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 00C22A8A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 00C22A94
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 00C22AA1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1bb009f4970c0bed6848a5fc3c218581053970cbf4147dbb239ee162c1869b61
Instruction ID: 8304d32aa60878ded689fdc59a1151a55b8f8a36d6116fca7ee3bd9e7939c8ac
Opcode Fuzzy Hash: 1bb009f4970c0bed6848a5fc3c218581053970cbf4147dbb239ee162c1869b61
Instruction Fuzzy Hash: 9831D77490122CABCB21DF64D9887DCBBB4AF18310F5041DAE41CA6260E7709FC59F45

Function 00C52010 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00C1014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00C109D8
Part of subcall function 00C1014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00C109F5

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C5205A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C52087
GetLastError.KERNEL32 ref: 00C52097

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 40f6542514de42eff3fd98303af171ef54b9f564b1740c8d58e0e18ee410bb41
Instruction ID: c2cf4f6066ec2b2b8eddc721b82cbb26846ca8dbba7c9ae3ec0189f108a676e0
Opcode Fuzzy Hash: 40f6542514de42eff3fd98303af171ef54b9f564b1740c8d58e0e18ee410bb41
Instruction Fuzzy Hash: 13119DB2400204AFD718AF54ECC6E6FBBF8EB45711B20841EE45697291DB70AC85CB68

Function 00C15058 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00C1502E,?,00CB98D8,0000000C,00C15185,?,00000002,00000000), ref: 00C15079
TerminateProcess.KERNEL32(00000000,?,00C1502E,?,00CB98D8,0000000C,00C15185,?,00000002,00000000), ref: 00C15080
ExitProcess.KERNEL32 ref: 00C15092

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5957239dc9dc991a64352a81fe7fccb6c1eb3ad1dc3452dfa073bc42c546807a
Instruction ID: 8e60b8dedcbf571d33e6c6281d2875e8a07b6a9ad476630e1c8505ed8b6ffd90
Opcode Fuzzy Hash: 5957239dc9dc991a64352a81fe7fccb6c1eb3ad1dc3452dfa073bc42c546807a
Instruction Fuzzy Hash: DAE01231400648AFCB216F90DD08B983B69AB96381B004014F80A8A171DB35AA92EB84

Function 00C5ECD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00C5ED04

Strings

DOWN, xrefs: 00C5ECE9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: 2cdf481b8f8bbea7009cb3e658276235303deb07ef829ddf2b3bfae9a2a0f710
Instruction ID: 718c627ad8d0e8c6b2c1dea546bed4a4ccb80496011b2e6fc4deb1b2507eecd7
Opcode Fuzzy Hash: 2cdf481b8f8bbea7009cb3e658276235303deb07ef829ddf2b3bfae9a2a0f710
Instruction Fuzzy Hash: 20E086691DD72178FD4C2114BC07EF7034C8F12735B110156FC10D80C0ED505EC661AD

Function 00C4E652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00C4E664

Strings

X64, xrefs: 00C4E680

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 30d06ccbc0eed2bb8b174d3b42297a40dafca58c522c422347a2929881f437d1
Instruction ID: 73f94ad7df3ed3eb91d3aa2b170e430a87be029b5a265bb15935e273713299fe
Opcode Fuzzy Hash: 30d06ccbc0eed2bb8b174d3b42297a40dafca58c522c422347a2929881f437d1
Instruction Fuzzy Hash: 14D0C9B480511DEACF80CB90EC88EDD777CBB04304F110A51F106A2040D73095488B24

Function 00C641FA Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00C752EE,?,?,00000035,?), ref: 00C64229
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00C752EE,?,?,00000035,?), ref: 00C64239

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: fc5ef27ad614eee87215ea00f07c61a7530b754b41c093906617f67c7b959c85
Instruction ID: eef5c4213bc20979c699d0704488ca116ab590a7abcdfe878014b2fad7ae86e1
Opcode Fuzzy Hash: fc5ef27ad614eee87215ea00f07c61a7530b754b41c093906617f67c7b959c85
Instruction Fuzzy Hash: 9BF0A0706002286AEB2416A6AC4DFEB376EEF85761F100165B605D3185D9609A4087B0

Function 00C5BBED Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00C5BC24
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00C5BC37

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: cf443675115b993e4b36a894f1055d49826afc85926f421968865ef10dd310ee
Instruction ID: 3e8dcf192d6775d296caa2d840ea26390deddec583126caa55aba9f3b9b523a0
Opcode Fuzzy Hash: cf443675115b993e4b36a894f1055d49826afc85926f421968865ef10dd310ee
Instruction Fuzzy Hash: 24F0907480024DABDB019FA0C806BFEBFB0FF04309F00800AF951A5191C3798605DF98

Function 00C51A0B Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C51B48), ref: 00C51A20
CloseHandle.KERNEL32(?,?,00C51B48), ref: 00C51A35

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 125c81ad9aebb00ce33cf7d504d80e9d00c4617007e2cec4b8b02c532750d343
Instruction ID: c0165a8652262a4aa5e4be6478ce4b999026b028263060f323b266119f1b947d
Opcode Fuzzy Hash: 125c81ad9aebb00ce33cf7d504d80e9d00c4617007e2cec4b8b02c532750d343
Instruction Fuzzy Hash: 02E09A72014610BEE7252B50FC09FBA77A9EB04321F24891EB9A6854B0DBA26CD1EB54

Function 00C6F4FF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C6F51A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 52c5cd117d23f3ed6869785b370b1a8eb9b9ca27df79bd840723f21514835408
Instruction ID: 17544c7ff245f8ba0b1ced210b6b7a0ba7c13d10266928cd6547d07ac7332d1b
Opcode Fuzzy Hash: 52c5cd117d23f3ed6869785b370b1a8eb9b9ca27df79bd840723f21514835408
Instruction Fuzzy Hash: 95E048312002095FC710DF69E444A5AF7D8AFA4761F008469F94AC7351D670FD458B95

Function 00C10D45 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020D51,00C1075E), ref: 00C10D4A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1e85761a706778d1c429918bea8370d6ed6c2adc018fcbbb48af4169bfef9559
Instruction ID: 2241e2825aa252b46e0db62a70c684f2e0024da2cd2d91df62739064b501383c
Opcode Fuzzy Hash: 1e85761a706778d1c429918bea8370d6ed6c2adc018fcbbb48af4169bfef9559
Instruction Fuzzy Hash:

Function 00C7353B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C7358D
DeleteObject.GDI32(00000000), ref: 00C735A0
DestroyWindow.USER32 ref: 00C735AF
GetDesktopWindow.USER32 ref: 00C735CA
GetWindowRect.USER32(00000000), ref: 00C735D1
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00C73700
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00C7370E
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C73755
GetClientRect.USER32(00000000,?), ref: 00C73761
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C7379D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C737BF
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C737D2
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C737DD
GlobalLock.KERNEL32(00000000), ref: 00C737E6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C737F5
GlobalUnlock.KERNEL32(00000000), ref: 00C737FE
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C73805
GlobalFree.KERNEL32(00000000), ref: 00C73810
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C73822
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C90C04,00000000), ref: 00C73838
GlobalFree.KERNEL32(00000000), ref: 00C73848
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00C7386E
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00C7388D
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C738AF
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C73A9C

Strings

DISPLAY, xrefs: 00C738FF
static, xrefs: 00C73797, 00C738EE
, xrefs: 00C73A22
AutoIt v3, xrefs: 00C7374F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 7df538ea3b10036f2ff7e2614cc5b8c85eb12b2146d28fddf3662656ac383f53
Instruction ID: da3972eb9f9c6fa8a347bf254e03fa99c9e78d0bd10d099582b7734efd4f255b
Opcode Fuzzy Hash: 7df538ea3b10036f2ff7e2614cc5b8c85eb12b2146d28fddf3662656ac383f53
Instruction Fuzzy Hash: D9026C71500209AFDB14DF64CD89FAE7BB9FB48310F048558F91AAB2A0DB74EE05DB64

Function 00C87B0D Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C87B67
GetSysColorBrush.USER32(0000000F), ref: 00C87B98
GetSysColor.USER32(0000000F), ref: 00C87BA4
SetBkColor.GDI32(?,000000FF), ref: 00C87BBE
SelectObject.GDI32(?,?), ref: 00C87BCD
InflateRect.USER32(?,000000FF,000000FF), ref: 00C87BF8
GetSysColor.USER32(00000010), ref: 00C87C00
CreateSolidBrush.GDI32(00000000), ref: 00C87C07
FrameRect.USER32(?,?,00000000), ref: 00C87C16
DeleteObject.GDI32(00000000), ref: 00C87C1D
InflateRect.USER32(?,000000FE,000000FE), ref: 00C87C68
FillRect.USER32(?,?,?), ref: 00C87C9A
GetWindowLongW.USER32(?,000000F0), ref: 00C87CBC

Part of subcall function 00C87E22: GetSysColor.USER32(00000012), ref: 00C87E5B
Part of subcall function 00C87E22: SetTextColor.GDI32(?,00C87B2D), ref: 00C87E5F
Part of subcall function 00C87E22: GetSysColorBrush.USER32(0000000F), ref: 00C87E75
Part of subcall function 00C87E22: GetSysColor.USER32(0000000F), ref: 00C87E80
Part of subcall function 00C87E22: GetSysColor.USER32(00000011), ref: 00C87E9D
Part of subcall function 00C87E22: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C87EAB
Part of subcall function 00C87E22: SelectObject.GDI32(?,00000000), ref: 00C87EBC
Part of subcall function 00C87E22: SetBkColor.GDI32(?,?), ref: 00C87EC5
Part of subcall function 00C87E22: SelectObject.GDI32(?,?), ref: 00C87ED2
Part of subcall function 00C87E22: InflateRect.USER32(?,000000FF,000000FF), ref: 00C87EF1
Part of subcall function 00C87E22: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C87F08
Part of subcall function 00C87E22: GetWindowLongW.USER32(?,000000F0), ref: 00C87F15

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 1be8341b7937a05d6896d0d22e5265ea9145f4aceb6ed506ed0aafda0acd0f43
Instruction ID: f0d01dd99784ca0d49034def48af3f15e3714a594a80d0abb0979b6ae418b9c2
Opcode Fuzzy Hash: 1be8341b7937a05d6896d0d22e5265ea9145f4aceb6ed506ed0aafda0acd0f43
Instruction Fuzzy Hash: CAA15972008301AFDB11AF64DC48F6EBBA9FF49325F200B19FA63961E0E775D9448B59

Function 00BF1625 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00BF16B4
SendMessageW.USER32(?,00001308,?,00000000), ref: 00C32B07
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00C32B40
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00C32F85

Part of subcall function 00BF1802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BF1488,?,00000000,?,?,?,?,00BF145A,00000000,?), ref: 00BF1865

SendMessageW.USER32(?,00001053), ref: 00C32FC1
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00C32FD8
ImageList_Destroy.COMCTL32(00000000,?), ref: 00C32FEE
ImageList_Destroy.COMCTL32(00000000,?), ref: 00C32FF9

Strings

0, xrefs: 00C32E11

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: a1d2d1e1d324c7c5fa19276efdbfaa54194127bfadf3e8ba4b126f59e3f921e2
Instruction ID: cd3f3f0681d175dc495800f764df7a8ec4dd50bfa228e824bb9c02ba1a201a8b
Opcode Fuzzy Hash: a1d2d1e1d324c7c5fa19276efdbfaa54194127bfadf3e8ba4b126f59e3f921e2
Instruction Fuzzy Hash: A712BC30210205EFDB25DF18D884BBABBE5FB44304F1889A9F5A5DB261C731ED86DB91

Function 00C7316E Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C7319B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C732C7
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00C73306
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00C73316
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00C7335D
GetClientRect.USER32(00000000,?), ref: 00C73369
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00C733B2
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C733C1
GetStockObject.GDI32(00000011), ref: 00C733D1
SelectObject.GDI32(00000000,00000000), ref: 00C733D5
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00C733E5
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C733EE
DeleteDC.GDI32(00000000), ref: 00C733F7
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C73423
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C7343A
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00C7347A
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C7348E
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C7349F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00C734D4
GetStockObject.GDI32(00000011), ref: 00C734DF
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C734EA
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00C734F4

Strings

DISPLAY, xrefs: 00C733B7
static, xrefs: 00C733AC, 00C734CE
msctls_progress32, xrefs: 00C73470
AutoIt v3, xrefs: 00C73355

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 66c22f67d8c30eb18d164264e35bab713c168d18da1854d180328bcc342a6118
Instruction ID: c09a39e07beb0db9856ff89759fe4388884dbecce378ac71517d5be00bd7f471
Opcode Fuzzy Hash: 66c22f67d8c30eb18d164264e35bab713c168d18da1854d180328bcc342a6118
Instruction Fuzzy Hash: 7DB15D71A00249AFEB14DFA8DD49FAE7BB9EB48710F008154FA15E72E1DB74AD40CB94

Function 00C65524 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C65532
GetDriveTypeW.KERNEL32(?,00C8DC30,?,\\.\,00C8DCD0), ref: 00C6560F
SetErrorMode.KERNEL32(00000000,00C8DC30,?,\\.\,00C8DCD0), ref: 00C6577B

Strings

CDROM, xrefs: 00C65640
Fixed, xrefs: 00C6564E
ATAPI, xrefs: 00C656D6
iSCSI, xrefs: 00C65707
ATA, xrefs: 00C656DD
SAS, xrefs: 00C6570E
USB, xrefs: 00C656F9
Fibre, xrefs: 00C656F2
RAMDisk, xrefs: 00C65639
SCSI, xrefs: 00C656CF
SSD, xrefs: 00C6568F
FileBackedVirtual, xrefs: 00C65731
MMC, xrefs: 00C65723
PhysicalDrive, xrefs: 00C655BB
Network, xrefs: 00C65647
RAID, xrefs: 00C65700
SSA, xrefs: 00C656EB
\\.\, xrefs: 00C65584
Removable, xrefs: 00C65655, 00C6565A
Unknown, xrefs: 00C65632, 00C656C8
Virtual, xrefs: 00C6572A
1394, xrefs: 00C656E4
SATA, xrefs: 00C65715

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: d395311c4dd0875d60cf97dce29c1dce9630c3027b70f8fb0913e18a7b62b4f3
Instruction ID: e2240b0c6187d2ffd66738e4907380e18934ccc1b1a2207dc4b439a3d4c946c1
Opcode Fuzzy Hash: d395311c4dd0875d60cf97dce29c1dce9630c3027b70f8fb0913e18a7b62b4f3
Instruction Fuzzy Hash: 4361DE30A48A09DFCB34DF24C9D29B877A1EF94390F348165E916AB291C731DE85DB51

Function 00C81A8F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C81BC4
GetDesktopWindow.USER32 ref: 00C81BD9
GetWindowRect.USER32(00000000), ref: 00C81BE0
GetWindowLongW.USER32(?,000000F0), ref: 00C81C35
DestroyWindow.USER32(?), ref: 00C81C55
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C81C89
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C81CA7
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C81CB9
SendMessageW.USER32(00000000,00000421,?,?), ref: 00C81CCE
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00C81CE1
IsWindowVisible.USER32(00000000), ref: 00C81D3D
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00C81D58
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00C81D6C
GetWindowRect.USER32(00000000,?), ref: 00C81D84
MonitorFromPoint.USER32(?,?,00000002), ref: 00C81DAA
GetMonitorInfoW.USER32(00000000,?), ref: 00C81DC4
CopyRect.USER32(?,?), ref: 00C81DDB
SendMessageW.USER32(00000000,00000412,00000000), ref: 00C81E46

Strings

(, xrefs: 00C81DB7
0, xrefs: 00C81B6F
tooltips_class32, xrefs: 00C81C82

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 98a687458cad88765af095c50ccb1f0e15de5c693da1efdcb3c9def54e0aaddf
Instruction ID: 3400f8f0e9ec123b7030cce9011b8b5b6b8820fc536b127064b1bf42c6fbd797
Opcode Fuzzy Hash: 98a687458cad88765af095c50ccb1f0e15de5c693da1efdcb3c9def54e0aaddf
Instruction Fuzzy Hash: 07B1AB71604301AFD704EF64C884B6EBBE9FF84314F04891CF99A9B2A1D771E945CB9A

Function 00C80CDD Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C80D81
_wcslen.LIBCMT ref: 00C80DBB
_wcslen.LIBCMT ref: 00C80E25
_wcslen.LIBCMT ref: 00C80E8D
_wcslen.LIBCMT ref: 00C80F11
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00C80F61
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C80FA0

Part of subcall function 00C0FD52: _wcslen.LIBCMT ref: 00C0FD5D

Part of subcall function 00C52B8C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C52BA5
Part of subcall function 00C52B8C: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C52BD7

Strings

DESELECT, xrefs: 00C81038
SELECTCLEAR, xrefs: 00C80FC9
FINDITEM, xrefs: 00C810C3
GETTEXT, xrefs: 00C80E88, 00C80EA3
GETSELECTED, xrefs: 00C8107D
GETITEMCOUNT, xrefs: 00C80DB2, 00C80DD3
GETSELECTEDCOUNT, xrefs: 00C80F0C, 00C80F27
SELECT, xrefs: 00C80FE4
SELECTALL, xrefs: 00C80FB1
GETSUBITEMCOUNT, xrefs: 00C80E20, 00C80E3B
ISSELECTED, xrefs: 00C80F79
VIEWCHANGE, xrefs: 00C81111
SELECTINVERT, xrefs: 00C8101A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: ec45c5406f4faa3284f13f006781a712bce8ab5e82582fa23b27373b86a95c83
Instruction ID: c37057f7cbc417f26ab32f4e1a0b42e7f1d5e7a0575a546c19876f628a18a0f2
Opcode Fuzzy Hash: ec45c5406f4faa3284f13f006781a712bce8ab5e82582fa23b27373b86a95c83
Instruction Fuzzy Hash: 4EE1B1312043418FC754EF24C95187AB7E6BF85318F14896DF8A6973A1DB30EE4ACB55

Function 00BF2521 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BF25F8
GetSystemMetrics.USER32(00000007), ref: 00BF2600
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BF262B
GetSystemMetrics.USER32(00000008), ref: 00BF2633
GetSystemMetrics.USER32(00000004), ref: 00BF2658
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BF2675
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BF2685
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BF26B8
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BF26CC
GetClientRect.USER32(00000000,000000FF), ref: 00BF26EA
GetStockObject.GDI32(00000011), ref: 00BF2706
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BF2711

Part of subcall function 00BF19CD: GetCursorPos.USER32(?), ref: 00BF19E1
Part of subcall function 00BF19CD: ScreenToClient.USER32(00000000,?), ref: 00BF19FE
Part of subcall function 00BF19CD: GetAsyncKeyState.USER32(00000001), ref: 00BF1A23
Part of subcall function 00BF19CD: GetAsyncKeyState.USER32(00000002), ref: 00BF1A3D

SetTimer.USER32(00000000,00000000,00000028,00BF199C), ref: 00BF2738

Strings

AutoIt v3 GUI, xrefs: 00BF26B0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 76695b6c9c175345c53b59a732a3817c4c009af790407721ea1059bfa59763eb
Instruction ID: 619d4e01f6c8e5567247635ee3a9c6ee871517a3cd1c55ed809c2059c6aeff70
Opcode Fuzzy Hash: 76695b6c9c175345c53b59a732a3817c4c009af790407721ea1059bfa59763eb
Instruction Fuzzy Hash: 16B15A71A00209EFDB14DFA8CC95BAE7BB5FB48314F104229FA16AB2D0DB74E941CB55

Function 00C516D7 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C51A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C51A60
Part of subcall function 00C51A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A6C
Part of subcall function 00C51A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A7B
Part of subcall function 00C51A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A82
Part of subcall function 00C51A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C51A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C51741
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C51775
GetLengthSid.ADVAPI32(?), ref: 00C5178C
GetAce.ADVAPI32(?,00000000,?), ref: 00C517C6
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C517E2
GetLengthSid.ADVAPI32(?), ref: 00C517F9
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00C51801
HeapAlloc.KERNEL32(00000000), ref: 00C51808
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C51829
CopySid.ADVAPI32(00000000), ref: 00C51830
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C5185F
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C51881
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C51893
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C518BA
HeapFree.KERNEL32(00000000), ref: 00C518C1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C518CA
HeapFree.KERNEL32(00000000), ref: 00C518D1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C518DA
HeapFree.KERNEL32(00000000), ref: 00C518E1
GetProcessHeap.KERNEL32(00000000,?), ref: 00C518ED
HeapFree.KERNEL32(00000000), ref: 00C518F4

Part of subcall function 00C51ADF: GetProcessHeap.KERNEL32(00000008,00C514FD,?,00000000,?,00C514FD,?), ref: 00C51AED
Part of subcall function 00C51ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00C514FD,?), ref: 00C51AF4
Part of subcall function 00C51ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00C514FD,?), ref: 00C51B03

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 6ac1046f177f772569c710c3aebc92a0c758ddaf2b84f10793c533f2ad43547c
Instruction ID: 20134c8131e663a76bd3fd25aafd0c8006064e4d22eea0754c5c0d9645c2d757
Opcode Fuzzy Hash: 6ac1046f177f772569c710c3aebc92a0c758ddaf2b84f10793c533f2ad43547c
Instruction Fuzzy Hash: 0A7159B6D00209ABDF20DFA5DC48FAEBBB8FF04361F194125FD25A6190D7319A49CB64

Function 00C7CE17 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C7CF1D
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C8DCD0,00000000,?,00000000,?,?), ref: 00C7CFA4
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00C7D004
_wcslen.LIBCMT ref: 00C7D054
_wcslen.LIBCMT ref: 00C7D0CF
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00C7D112
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00C7D221
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00C7D2AD
RegCloseKey.ADVAPI32(?), ref: 00C7D2E1
RegCloseKey.ADVAPI32(00000000), ref: 00C7D2EE
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00C7D3C0

Strings

REG_MULTI_SZ, xrefs: 00C7D155
REG_DWORD, xrefs: 00C7D264
REG_BINARY, xrefs: 00C7D373
REG_EXPAND_SZ, xrefs: 00C7D02D
REG_QWORD, xrefs: 00C7D323
REG_SZ, xrefs: 00C7D0A4

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 2bc430b951777130e826f4ac50c55b367869cec349c564fbe236af77ffbabeff
Instruction ID: fd46919342592fa2b2db9cb37bd4cee8ed035ec30082774ba0df8d28257f0548
Opcode Fuzzy Hash: 2bc430b951777130e826f4ac50c55b367869cec349c564fbe236af77ffbabeff
Instruction Fuzzy Hash: 2A1237356042059FDB14EF14C881B2AB7F5EF89714F14889DF99A9B3A2CB31ED46CB81

Function 00C813BA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C81462
_wcslen.LIBCMT ref: 00C8149D
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C814F0
_wcslen.LIBCMT ref: 00C81526
_wcslen.LIBCMT ref: 00C815A2
_wcslen.LIBCMT ref: 00C8161D

Part of subcall function 00C0FD52: _wcslen.LIBCMT ref: 00C0FD5D

Part of subcall function 00C53535: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C53547

Strings

ISCHECKED, xrefs: 00C8177D
GETITEMCOUNT, xrefs: 00C816BA
EXPAND, xrefs: 00C81694
SELECT, xrefs: 00C817AD
COLLAPSE, xrefs: 00C8159D, 00C815B8
EXISTS, xrefs: 00C81618, 00C81633
CHECK, xrefs: 00C81521, 00C8153C
GETTOTALCOUNT, xrefs: 00C8148E, 00C814B3
UNCHECK, xrefs: 00C817DA
GETSELECTED, xrefs: 00C816EA
GETTEXT, xrefs: 00C81733

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: c68fdea4362489eb04e401625a38dcf39393b5d5dd9aacd805c1cd3f1ced1bd0
Instruction ID: 4ecb2ded3bbe44551e77adcf53f045a68c57825461891f5cdbd5a9b347def8d2
Opcode Fuzzy Hash: c68fdea4362489eb04e401625a38dcf39393b5d5dd9aacd805c1cd3f1ced1bd0
Instruction Fuzzy Hash: CAE1A2756043018FCB14EF25C45186AB7E6FF94318F18495DF8A69B3A2DB30EE4ACB85

Function 00C7D3F8 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7C10E,?,?), ref: 00C7D415
_wcslen.LIBCMT ref: 00C7D451
_wcslen.LIBCMT ref: 00C7D4C8
_wcslen.LIBCMT ref: 00C7D4FE
_wcslen.LIBCMT ref: 00C7D559
_wcslen.LIBCMT ref: 00C7D58F
_wcslen.LIBCMT ref: 00C7D5DF

Strings

HKCU, xrefs: 00C7D62E
HKEY_LOCAL_MACHINE, xrefs: 00C7D4C2, 00C7D4C7
HKU, xrefs: 00C7D650
HKLM, xrefs: 00C7D4F8, 00C7D4FD
HKCC, xrefs: 00C7D60C
HKEY_CURRENT_CONFIG, xrefs: 00C7D5D9, 00C7D5DE
HKEY_USERS, xrefs: 00C7D63F
HKEY_CURRENT_USER, xrefs: 00C7D61D
HKEY_CLASSES_ROOT, xrefs: 00C7D553, 00C7D558
HKCR, xrefs: 00C7D589, 00C7D58E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: f742fb0f2d45718e1fcb0513c7ea080b8319544e536d926ac5771c7d92d25b0a
Instruction ID: f94bfbd7e796a3a205b1b389292524cffa120379b593e0193df9fc1232dd821c
Opcode Fuzzy Hash: f742fb0f2d45718e1fcb0513c7ea080b8319544e536d926ac5771c7d92d25b0a
Instruction Fuzzy Hash: 7071F9B260012A8BCF109E7CC9515FB33B5AF60768F258524F87FA7294EA35DE85D390

Function 00C88D97 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C88DB5
_wcslen.LIBCMT ref: 00C88DC9
_wcslen.LIBCMT ref: 00C88DEC
_wcslen.LIBCMT ref: 00C88E0F
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C88E4D
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00C86691), ref: 00C88EA9
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C88EE2
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C88F25
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C88F5C
FreeLibrary.KERNEL32(?), ref: 00C88F68
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C88F78
DestroyIcon.USER32(?,?,?,?,?,00C86691), ref: 00C88F87
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C88FA4
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C88FB0

Strings

.icl, xrefs: 00C88DC3
.exe, xrefs: 00C88DE3
.dll, xrefs: 00C88E06

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 36ec1a5dc23352ac29a14b1fb9fe725f0d832fc3c5a106c3786b64e6abcf206e
Instruction ID: 60745e876c4f701ac46c2c88087b840d0e1bc0216cd7ed15a3f3059a0bd252ec
Opcode Fuzzy Hash: 36ec1a5dc23352ac29a14b1fb9fe725f0d832fc3c5a106c3786b64e6abcf206e
Instruction Fuzzy Hash: BE612371900219BEEB14EFA4CC41BFE77A8BF09B14F504106FA25D60D0DB74AA88DBA4

Function 00C648BE Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C6493D
_wcslen.LIBCMT ref: 00C64948
_wcslen.LIBCMT ref: 00C6499F
_wcslen.LIBCMT ref: 00C649DD
GetDriveTypeW.KERNEL32(?), ref: 00C64A1B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C64A63
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C64A9E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C64ACC

Strings

open , xrefs: 00C64A2A
set cd door , xrefs: 00C64A6D
close cd wait, xrefs: 00C64AB7
close, xrefs: 00C64943, 00C6495D
closed, xrefs: 00C6494D, 00C64972, 00C6498B, 00C649C3, 00C649DC
wait, xrefs: 00C64A89
type cdaudio alias cd wait, xrefs: 00C64A46
open, xrefs: 00C64999, 00C6499E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 472e9004befc357317bf72913120fa14f79331c2cc2d037d30d89d406f4fa45b
Instruction ID: c91f5238a2e7c7c78d1f20d144801c940e7dbcd12d28ce446ffb6ddf9c30f517
Opcode Fuzzy Hash: 472e9004befc357317bf72913120fa14f79331c2cc2d037d30d89d406f4fa45b
Instruction Fuzzy Hash: 0171E3725082059FC724EF24C88097FB7E8EF94758F00496DF8A697262EB31DE49CB91

Function 00C56382 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00C56395
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00C563A7
SetWindowTextW.USER32(?,?), ref: 00C563BE
GetDlgItem.USER32(?,000003EA), ref: 00C563D3
SetWindowTextW.USER32(00000000,?), ref: 00C563D9
GetDlgItem.USER32(?,000003E9), ref: 00C563E9
SetWindowTextW.USER32(00000000,?), ref: 00C563EF
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00C56410
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00C5642A
GetWindowRect.USER32(?,?), ref: 00C56433
_wcslen.LIBCMT ref: 00C5649A
SetWindowTextW.USER32(?,?), ref: 00C564D6
GetDesktopWindow.USER32 ref: 00C564DC
GetWindowRect.USER32(00000000), ref: 00C564E3
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00C5653A
GetClientRect.USER32(?,?), ref: 00C56547
PostMessageW.USER32(?,00000005,00000000,?), ref: 00C5656C
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00C56596

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: b96f5eea6fa42dee57d482106851ef67b8a6f65e387e63faf30e4ed5aa1082b5
Instruction ID: d0dd2edcc53bdb228364b62aa860b300b3ef1dc989a789caddfa477b16bad144
Opcode Fuzzy Hash: b96f5eea6fa42dee57d482106851ef67b8a6f65e387e63faf30e4ed5aa1082b5
Instruction Fuzzy Hash: 1071B235900709AFDB20DFA8CE45BAEBBF5FF08705F500918E596A35A0D771EA84CB54

Function 00C7086B Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00C70884
LoadCursorW.USER32(00000000,00007F8A), ref: 00C7088F
LoadCursorW.USER32(00000000,00007F00), ref: 00C7089A
LoadCursorW.USER32(00000000,00007F03), ref: 00C708A5
LoadCursorW.USER32(00000000,00007F8B), ref: 00C708B0
LoadCursorW.USER32(00000000,00007F01), ref: 00C708BB
LoadCursorW.USER32(00000000,00007F81), ref: 00C708C6
LoadCursorW.USER32(00000000,00007F88), ref: 00C708D1
LoadCursorW.USER32(00000000,00007F80), ref: 00C708DC
LoadCursorW.USER32(00000000,00007F86), ref: 00C708E7
LoadCursorW.USER32(00000000,00007F83), ref: 00C708F2
LoadCursorW.USER32(00000000,00007F85), ref: 00C708FD
LoadCursorW.USER32(00000000,00007F82), ref: 00C70908
LoadCursorW.USER32(00000000,00007F84), ref: 00C70913
LoadCursorW.USER32(00000000,00007F04), ref: 00C7091E
LoadCursorW.USER32(00000000,00007F02), ref: 00C70929
GetCursorInfo.USER32(?), ref: 00C70939
GetLastError.KERNEL32 ref: 00C7097B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: cb46c69401af0be4ece8e5b70d9a9fbf178f9d64420a75b9bbd4a7db2f09eec3
Instruction ID: 8d144e098b70020dc20c81f69af082f8d6bf8b1950f4ecd12ce4371554f10925
Opcode Fuzzy Hash: cb46c69401af0be4ece8e5b70d9a9fbf178f9d64420a75b9bbd4a7db2f09eec3
Instruction Fuzzy Hash: EC4165B0D08319AADB10DFBA8C85C6EBFE8FF44754B50852AE11DE7291DA78D901CF91

Function 00C10436 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00C10436

Part of subcall function 00C1045D: InitializeCriticalSectionAndSpinCount.KERNEL32(00CC170C,00000FA0,E36707F3,?,?,?,?,00C32733,000000FF), ref: 00C1048C
Part of subcall function 00C1045D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00C32733,000000FF), ref: 00C10497
Part of subcall function 00C1045D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00C32733,000000FF), ref: 00C104A8
Part of subcall function 00C1045D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00C104BE
Part of subcall function 00C1045D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00C104CC
Part of subcall function 00C1045D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00C104DA
Part of subcall function 00C1045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00C10505
Part of subcall function 00C1045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00C10510

___scrt_fastfail.LIBCMT ref: 00C10457

Part of subcall function 00C10413: __onexit.LIBCMT ref: 00C10419

Strings

SleepConditionVariableCS, xrefs: 00C104C4
kernel32.dll, xrefs: 00C104A3
WakeAllConditionVariable, xrefs: 00C104D2
InitializeConditionVariable, xrefs: 00C104B8
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00C10492

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: e755646c2243cbddb2c49fd37a4315e2367005b68cb1b8e7087c1d02a47edfe8
Instruction ID: 35dd5c52640e5962fbde9831c806885d63ab049f69a9894187977438eddb33af
Opcode Fuzzy Hash: e755646c2243cbddb2c49fd37a4315e2367005b68cb1b8e7087c1d02a47edfe8
Instruction Fuzzy Hash: F621C233A44704AFD7106BA4AC4AFED3795EF07B61F240139F902922D1DEB098C0AB98

Function 00C53A43 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C53AD9
_wcslen.LIBCMT ref: 00C53B44

Strings

CLASSNN, xrefs: 00C53B3F, 00C53B50
TEXT, xrefs: 00C53DC8
REGEXPCLASS, xrefs: 00C53BA1, 00C53BB2
CLASS, xrefs: 00C53AD4, 00C53AF1
NAME, xrefs: 00C53C81, 00C53C92
INSTANCE, xrefs: 00C53D9F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 17de1d13ab93f55323ae0ff20672fb899c86f6c101236f113f68ea6df27f12b2
Instruction ID: 460dc51f266c663bcd7db393a474316f851eb31675f1151f4a746d808672f2f9
Opcode Fuzzy Hash: 17de1d13ab93f55323ae0ff20672fb899c86f6c101236f113f68ea6df27f12b2
Instruction Fuzzy Hash: A3E10436A00556ABCF189FB4C8516EDFBB0BF14791F104229E866E7250DB30AFCDA794

Function 00C64F05 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00C8DCD0), ref: 00C64F6C
_wcslen.LIBCMT ref: 00C64F80
_wcslen.LIBCMT ref: 00C64FDE
_wcslen.LIBCMT ref: 00C65039
_wcslen.LIBCMT ref: 00C65084
_wcslen.LIBCMT ref: 00C650EC

Part of subcall function 00C0FD52: _wcslen.LIBCMT ref: 00C0FD5D

GetDriveTypeW.KERNEL32(?,00CB7C10,00000061), ref: 00C65188

Strings

removable, xrefs: 00C6502F, 00C65034
all, xrefs: 00C64F76, 00C64F7B
network, xrefs: 00C650E2, 00C650E7
unknown, xrefs: 00C6514D
fixed, xrefs: 00C6507A, 00C6507F
cdrom, xrefs: 00C64FD4, 00C64FD9
ramdisk, xrefs: 00C65136

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 34a17d7def815a3126dcfd9124f4f47e6e90b231b9ba5771a04a293cdda4a92f
Instruction ID: 2f2c5f9768852286ae759611f730806fc8a18798ca4e755c8674f290b8cf437b
Opcode Fuzzy Hash: 34a17d7def815a3126dcfd9124f4f47e6e90b231b9ba5771a04a293cdda4a92f
Instruction Fuzzy Hash: FCB1C0716087029FC724EF28C8D0A7EB7E5AFA5724F60491DF5A6C7291DB30D984CB92

Function 00C7BA59 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C7BBF8
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C7BC10
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C7BC34
_wcslen.LIBCMT ref: 00C7BC60
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C7BC74
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C7BC96
_wcslen.LIBCMT ref: 00C7BD92

Part of subcall function 00C60F4E: GetStdHandle.KERNEL32(000000F6), ref: 00C60F6D

_wcslen.LIBCMT ref: 00C7BDAB
_wcslen.LIBCMT ref: 00C7BDC6
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C7BE16
GetLastError.KERNEL32(00000000), ref: 00C7BE67
CloseHandle.KERNEL32(?), ref: 00C7BE99
CloseHandle.KERNEL32(00000000), ref: 00C7BEAA
CloseHandle.KERNEL32(00000000), ref: 00C7BEBC
CloseHandle.KERNEL32(00000000), ref: 00C7BECE
CloseHandle.KERNEL32(?), ref: 00C7BF43

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 2e5bc4c9ee403f417d50faeb5ee7d55eeb59ba0a1fe051b1c25eabe3dfd1f418
Instruction ID: 175f3073f23075340a676b9d9953d952136d96c4efd7db0a21b00302ea90886c
Opcode Fuzzy Hash: 2e5bc4c9ee403f417d50faeb5ee7d55eeb59ba0a1fe051b1c25eabe3dfd1f418
Instruction Fuzzy Hash: 52F1BF316043049FC715EF24C891B6EBBE1BF85314F18895DF99A8B2A2CB70ED45CB92

Function 00C74A46 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C8DCD0), ref: 00C74B18
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00C74B2A
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00C8DCD0), ref: 00C74B4F
FreeLibrary.KERNEL32(00000000,?,00C8DCD0), ref: 00C74B9B
StringFromGUID2.OLE32(?,?,00000028,?,00C8DCD0), ref: 00C74C05
SysFreeString.OLEAUT32(00000009), ref: 00C74CBF
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00C74D25
SysFreeString.OLEAUT32(?), ref: 00C74D4F

Strings

GetModuleHandleExW, xrefs: 00C74B24
kernel32.dll, xrefs: 00C74B13

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: fa41725991f43edc3181d17e03a56de77277cc976f15c115c9ecfea884d26291
Instruction ID: ea77baeb814094e205b4d92428c742b9dc0b1d528579922fd830d9d2cad6ea37
Opcode Fuzzy Hash: fa41725991f43edc3181d17e03a56de77277cc976f15c115c9ecfea884d26291
Instruction Fuzzy Hash: 78120A71A00119EFDB19DF94C888EAEBBB5FF45314F24C098E9199B251D731EE46CBA0

Function 00BF381F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00CC29C0), ref: 00C33F72
GetMenuItemCount.USER32(00CC29C0), ref: 00C34022
GetCursorPos.USER32(?), ref: 00C34066
SetForegroundWindow.USER32(00000000), ref: 00C3406F
TrackPopupMenuEx.USER32(00CC29C0,00000000,?,00000000,00000000,00000000), ref: 00C34082
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00C3408E

Strings

0, xrefs: 00BF382D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 627ed637df0b795233fefad2e5f3698af270bb24cacab7985d5a280ef3b78d98
Instruction ID: 8a52f55d77856c5620580141ec4c104b18ca869342688d46c6b24a7e1db3779a
Opcode Fuzzy Hash: 627ed637df0b795233fefad2e5f3698af270bb24cacab7985d5a280ef3b78d98
Instruction Fuzzy Hash: 39715A70A04305BFEB209F68DC89FAABFA5FF04764F100256F624A61E0C775AE54DB54

Function 00C87711 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00C87823

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C87897
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C878B9
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C878CC
DestroyWindow.USER32(?), ref: 00C878ED
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00BF0000,00000000), ref: 00C8791C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C87935
GetDesktopWindow.USER32 ref: 00C8794E
GetWindowRect.USER32(00000000), ref: 00C87955
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C8796D
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C87985

Part of subcall function 00BF2234: GetWindowLongW.USER32(?,000000EB), ref: 00BF2242

Strings

0, xrefs: 00C877D0
tooltips_class32, xrefs: 00C87890, 00C87915

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 9201d66827b2aa66c68c75b3dd8d5efb7c7d049b7dd09c6c895cd55163014e20
Instruction ID: af3714e36b316522c90dc44cc18984df4a0bfa709e4ab90bfc02c2c92b965654
Opcode Fuzzy Hash: 9201d66827b2aa66c68c75b3dd8d5efb7c7d049b7dd09c6c895cd55163014e20
Instruction Fuzzy Hash: 77718B70108244AFD725EF18CC48F6BBBE9FB89308F14065DF995972A1D770EA06DB19

Function 00C89B7A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

DragQueryPoint.SHELL32(?,?), ref: 00C89BA3

Part of subcall function 00C880AE: ClientToScreen.USER32(?,?), ref: 00C880D4
Part of subcall function 00C880AE: GetWindowRect.USER32(?,?), ref: 00C8814A
Part of subcall function 00C880AE: PtInRect.USER32(?,?,?), ref: 00C8815A

SendMessageW.USER32(?,000000B0,?,?), ref: 00C89C0C
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C89C17
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C89C3A
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C89C81
SendMessageW.USER32(?,000000B0,?,?), ref: 00C89C9A
SendMessageW.USER32(?,000000B1,?,?), ref: 00C89CB1
SendMessageW.USER32(?,000000B1,?,?), ref: 00C89CD3
DragFinish.SHELL32(?), ref: 00C89CDA
DefDlgProcW.USER32(?,00000233,?,00000000), ref: 00C89DCD

Strings

@GUI_DRAGID, xrefs: 00C89D45
@GUI_DROPID, xrefs: 00C89CFA
@GUI_DRAGFILE, xrefs: 00C89D7C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 2f60c40ad595e57c8691832abbae28cbe5ce5218e8cb1a56ab883f801adfb8d6
Instruction ID: f66d19c2c150cab97ff7dd0b948f270075c31d8738477bfa09d85c2f2e699351
Opcode Fuzzy Hash: 2f60c40ad595e57c8691832abbae28cbe5ce5218e8cb1a56ab883f801adfb8d6
Instruction Fuzzy Hash: 23618A71108305AFC701EF60DC85EAFBBE9EF89754F40092EF692931A1DB709A49CB56

Function 00C6CEBB Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C6CEF5
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C6CF08
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C6CF1C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00C6CF35
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00C6CF78
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00C6CF8E
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C6CF99
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C6CFC9
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C6D021
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C6D035
InternetCloseHandle.WININET(00000000), ref: 00C6D040

Strings

, xrefs: 00C6CFBA

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: f6a62dcf4263d81449f0d3b2485fdaba678ccd7875f89be265049e3ddbd27fba
Instruction ID: 2c65fb28d7cc7cba144c8c792b7e1f9e0c898b5bf0d61d5229580a48dc557d85
Opcode Fuzzy Hash: f6a62dcf4263d81449f0d3b2485fdaba678ccd7875f89be265049e3ddbd27fba
Instruction Fuzzy Hash: 405139B1A00608BFDB319FA1D8C8BBA7BBCFF08754F00441AF95696250D735DA45ABA1

Function 00C88FCB Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00C866D6,?,?), ref: 00C88FEE
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00C866D6,?,?,00000000,?), ref: 00C88FFE
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00C866D6,?,?,00000000,?), ref: 00C89009
CloseHandle.KERNEL32(00000000,?,?,?,?,00C866D6,?,?,00000000,?), ref: 00C89016
GlobalLock.KERNEL32(00000000), ref: 00C89024
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00C866D6,?,?,00000000,?), ref: 00C89033
GlobalUnlock.KERNEL32(00000000), ref: 00C8903C
CloseHandle.KERNEL32(00000000,?,?,?,?,00C866D6,?,?,00000000,?), ref: 00C89043
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00C866D6,?,?,00000000,?), ref: 00C89054
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C90C04,?), ref: 00C8906D
GlobalFree.KERNEL32(00000000), ref: 00C8907D
GetObjectW.GDI32(00000000,00000018,?), ref: 00C8909D
CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 00C890CD
DeleteObject.GDI32(00000000), ref: 00C890F5
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00C8910B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: ea9110f143b914ecad9316659bad7411f4d4d41abe750c7531353c980682d1f1
Instruction ID: b34e19b72d865a470523872ac0af35071e33daa87134798295ba727e0d82f130
Opcode Fuzzy Hash: ea9110f143b914ecad9316659bad7411f4d4d41abe750c7531353c980682d1f1
Instruction Fuzzy Hash: 26412775600209BFDB11AF65DC88FAE7BB8EF89725F144058F916D72A0D7309E41DB24

Function 00C7C06E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C7D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7C10E,?,?), ref: 00C7D415
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D451
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4C8
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C7C154
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C7C1D2
RegDeleteValueW.ADVAPI32(?,?), ref: 00C7C26A
RegCloseKey.ADVAPI32(?), ref: 00C7C2DE
RegCloseKey.ADVAPI32(?), ref: 00C7C2FC
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00C7C352
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C7C364
RegDeleteKeyW.ADVAPI32(?,?), ref: 00C7C382
FreeLibrary.KERNEL32(00000000), ref: 00C7C3E3
RegCloseKey.ADVAPI32(00000000), ref: 00C7C3F4

Strings

advapi32.dll, xrefs: 00C7C34D
RegDeleteKeyExW, xrefs: 00C7C35E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 58568cd6a3119342099791b2f916e84f3e14d1091f3effdc1ff39b0ca3b0f499
Instruction ID: 103fc956c4ce5228db75d6c2d9c795fd86e98b29122f9ac4cad41253aa38c39e
Opcode Fuzzy Hash: 58568cd6a3119342099791b2f916e84f3e14d1091f3effdc1ff39b0ca3b0f499
Instruction Fuzzy Hash: 6EC17B35204202AFD710DF24C4D5F6ABBE5BF84318F54C49CE56A8B2A2CB75ED46CB92

Function 00C72FB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C73035
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C73045
CreateCompatibleDC.GDI32(?), ref: 00C73051
SelectObject.GDI32(00000000,?), ref: 00C7305E
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00C730CA
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00C73109
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00C7312D
SelectObject.GDI32(?,?), ref: 00C73135
DeleteObject.GDI32(?), ref: 00C7313E
DeleteDC.GDI32(?), ref: 00C73145
ReleaseDC.USER32(00000000,?), ref: 00C73150

Strings

(, xrefs: 00C730EA

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 46897c4f0d596fdf51d77d987f09a3373601c77635c517b0c21bc64fefb511bc
Instruction ID: 0de7e4b692f5adce5d9de1ac65386fcd039b07a48fffccd6bf3d53026b44f68c
Opcode Fuzzy Hash: 46897c4f0d596fdf51d77d987f09a3373601c77635c517b0c21bc64fefb511bc
Instruction Fuzzy Hash: 19610375D00219EFCF04CFA4D884EAEBBB6FF48310F20841AE55AA7250D771AA41DF94

Function 00C8A94F Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 271windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

GetSystemMetrics.USER32(0000000F), ref: 00C8A990
GetSystemMetrics.USER32(00000011), ref: 00C8A9A7
GetSystemMetrics.USER32(00000004), ref: 00C8A9B3
GetSystemMetrics.USER32(0000000F), ref: 00C8A9C9
MoveWindow.USER32(00000003,?,?,00000001,?,00000000,?,00000000,?,00000000), ref: 00C8AC15
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00C8AC33
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00C8AC54
ShowWindow.USER32(00000003,00000000), ref: 00C8AC73
InvalidateRect.USER32(?,00000000,00000001), ref: 00C8AC95
DefDlgProcW.USER32(?,00000005,?), ref: 00C8ACBB

Strings

@, xrefs: 00C8ABD0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MetricsSystem$Window$MessageSend$InvalidateLongMoveProcRectShow
String ID: @
API String ID: 3962739598-2766056989
Opcode ID: 72db8d10d20f5ada6ffc3800d72e978cedec1e3366c0c200902a37ff324befec
Instruction ID: 86f9637c3ea184e3da2dc53ee965e9975a59c3d5fde3b8e1ae80e13ff52382a0
Opcode Fuzzy Hash: 72db8d10d20f5ada6ffc3800d72e978cedec1e3366c0c200902a37ff324befec
Instruction Fuzzy Hash: C3B1CC70600219EFEF14DF69C984BBE3BF2BF44708F04806AEC559B295D771AA80CB55

Function 00C552AA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00C552E6
GetWindowTextW.USER32(?,?,00000400), ref: 00C55328
_wcslen.LIBCMT ref: 00C55339
CharUpperBuffW.USER32(?,00000000), ref: 00C55345
_wcsstr.LIBVCRUNTIME ref: 00C5537A
GetClassNameW.USER32(00000018,?,00000400), ref: 00C553B2
GetWindowTextW.USER32(?,?,00000400), ref: 00C553EB
GetClassNameW.USER32(00000018,?,00000400), ref: 00C55445
GetClassNameW.USER32(?,?,00000400), ref: 00C55477
GetWindowRect.USER32(?,?), ref: 00C554EF

Strings

ThumbnailClass, xrefs: 00C553BD, 00C55450

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 44bf3b608ba727f24f1cada43bd8f6c174cd1ec2e5e3d2969ed449a033c01124
Instruction ID: 0e0fee53a5b36fe1669d94e263458a5b6c97c627f950c624e83f370e66c77c8f
Opcode Fuzzy Hash: 44bf3b608ba727f24f1cada43bd8f6c174cd1ec2e5e3d2969ed449a033c01124
Instruction Fuzzy Hash: 0091F879104B06AFD704CF24C8A4BAAB7B9FF41341F404519FE9A82191EB31EED9CB95

Function 00C8976A Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C897B6
GetFocus.USER32 ref: 00C897C6
GetDlgCtrlID.USER32(00000000), ref: 00C897D1
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 00C89879
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C8992B
GetMenuItemCount.USER32(?), ref: 00C89948
GetMenuItemID.USER32(?,00000000), ref: 00C89958
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C8998A
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C899CC
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C899FD

Strings

0, xrefs: 00C898FB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: af72a7056d297c320745eb73ac50c5888633b1df9298779e98ed539fc7b9f8fb
Instruction ID: e7a302b648ed56c4f639e135fe5e87fc287653fd22b815f0a0a48afe227724dd
Opcode Fuzzy Hash: af72a7056d297c320745eb73ac50c5888633b1df9298779e98ed539fc7b9f8fb
Instruction Fuzzy Hash: AA81C171504301AFD710EF25C884ABB7BE8FB89318F18092DF99597291DB70DA05DBA9

Function 00C5C8F7 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00CC29C0,000000FF,00000000,00000030), ref: 00C5C973
SetMenuItemInfoW.USER32(00CC29C0,00000004,00000000,00000030), ref: 00C5C9A8
Sleep.KERNEL32(000001F4), ref: 00C5C9BA
GetMenuItemCount.USER32(?), ref: 00C5CA00
GetMenuItemID.USER32(?,00000000), ref: 00C5CA1D
GetMenuItemID.USER32(?,-00000001), ref: 00C5CA49
GetMenuItemID.USER32(?,?), ref: 00C5CA90
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C5CAD6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C5CAEB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C5CB0C

Strings

0, xrefs: 00C5C904

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 4781e126a5494fd21d90e1a2c76fbe8fac7cfe055398cd55382b9ebd0aa628dc
Instruction ID: 795b81a467779167d111a2e9049d82139b45359a253ac5c82d7de65a9fa15d8d
Opcode Fuzzy Hash: 4781e126a5494fd21d90e1a2c76fbe8fac7cfe055398cd55382b9ebd0aa628dc
Instruction Fuzzy Hash: F1616CB8900349AFDF11CF64D8C9AAE7FA8FB05346F040055ED22A3291D734AE99DB64

Function 00C5E4C2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00C5E4D4
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00C5E4FA
_wcslen.LIBCMT ref: 00C5E504
_wcsstr.LIBVCRUNTIME ref: 00C5E554
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00C5E570

Strings

\VarFileInfo\Translation, xrefs: 00C5E568
DefaultLangCodepage, xrefs: 00C5E5D3
StringFileInfo\, xrefs: 00C5E543
04090000, xrefs: 00C5E5A6
%u.%u.%u.%u, xrefs: 00C5E64E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 71a34437c948dfc96002ec5a9969386a6abfaf974ab7a25188b4141e129f2ab3
Instruction ID: 82d051af1a33e4ab7ac64014577482f2e8a453f681400fabfc059069fb4de26b
Opcode Fuzzy Hash: 71a34437c948dfc96002ec5a9969386a6abfaf974ab7a25188b4141e129f2ab3
Instruction Fuzzy Hash: 714104725402187AEB04AB649C47EFF77ACEF52751F10006AF901A61C2FF759B81B3A9

Function 00C7D694 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C7D6C4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00C7D6ED
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C7D7A8

Part of subcall function 00C7D694: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00C7D70A
Part of subcall function 00C7D694: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00C7D71D
Part of subcall function 00C7D694: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C7D72F
Part of subcall function 00C7D694: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C7D765
Part of subcall function 00C7D694: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C7D788

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C7D753

Strings

advapi32.dll, xrefs: 00C7D718
RegDeleteKeyExW, xrefs: 00C7D729

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 470d8873124a90ffb4aa9837893e4bac8691e5341dfb7172ec3e160ac9400cca
Instruction ID: 73131e1b78d03346e93db829911691f1524dcb4b667711be476fd8f830f38eca
Opcode Fuzzy Hash: 470d8873124a90ffb4aa9837893e4bac8691e5341dfb7172ec3e160ac9400cca
Instruction Fuzzy Hash: 10318D72A01128BBDB259B90DC88FFFBB7CEF46710F004065B81BE2184DB309E459BA4

Function 00C5EFC7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C5EFCB

Part of subcall function 00C0F215: timeGetTime.WINMM(?,?,00C5EFEB), ref: 00C0F219

Sleep.KERNEL32(0000000A), ref: 00C5EFF8
EnumThreadWindows.USER32(?,Function_0006EF7C,00000000), ref: 00C5F01C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C5F03E
SetActiveWindow.USER32 ref: 00C5F05D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C5F06B
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C5F08A
Sleep.KERNEL32(000000FA), ref: 00C5F095
IsWindow.USER32 ref: 00C5F0A1
EndDialog.USER32(00000000), ref: 00C5F0B2

Strings

BUTTON, xrefs: 00C5F030

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 20534e9e3694d60367ebd337d128bbff317922c5679d5ecfd872d4e03a126260
Instruction ID: 455d0ec1dcb263be5ee0903c8aa17b8220977138b8334ea94fcaba27ee3438e0
Opcode Fuzzy Hash: 20534e9e3694d60367ebd337d128bbff317922c5679d5ecfd872d4e03a126260
Instruction Fuzzy Hash: 0321B079100244BFE7156F60EC89F6E7B69FB85716F044029F802822F2CB314D899719

Function 00C5F313 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C5F374
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C5F38A
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C5F39B
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C5F3AD
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C5F3BE

Strings

open , xrefs: 00C5F323
play PlayMe wait, xrefs: 00C5F3A8
play PlayMe, xrefs: 00C5F3B9
close PlayMe, xrefs: 00C5F385, 00C5F3B2
status PlayMe mode, xrefs: 00C5F36F
alias PlayMe, xrefs: 00C5F34D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: b1f8bf61c842f532b05978290a0a26e31d7ad80616ccabfa5d331a034284a9eb
Instruction ID: c3849d265586a8a62674069fd9b20ef0127ad5035da01d58fc1b20ce1814b77c
Opcode Fuzzy Hash: b1f8bf61c842f532b05978290a0a26e31d7ad80616ccabfa5d331a034284a9eb
Instruction Fuzzy Hash: F311E335A8011C39E724A761CC0AEFF7BBCEFD1B00F0005797D11E30E1DAA05949C5A0

Function 00C5A958 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C5A9D9
SetKeyboardState.USER32(?), ref: 00C5AA44
GetAsyncKeyState.USER32(000000A0), ref: 00C5AA64
GetKeyState.USER32(000000A0), ref: 00C5AA7B
GetAsyncKeyState.USER32(000000A1), ref: 00C5AAAA
GetKeyState.USER32(000000A1), ref: 00C5AABB
GetAsyncKeyState.USER32(00000011), ref: 00C5AAE7
GetKeyState.USER32(00000011), ref: 00C5AAF5
GetAsyncKeyState.USER32(00000012), ref: 00C5AB1E
GetKeyState.USER32(00000012), ref: 00C5AB2C
GetAsyncKeyState.USER32(0000005B), ref: 00C5AB55
GetKeyState.USER32(0000005B), ref: 00C5AB63

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 5ad745fddc7de5a9e05b059a4e2e0316d9a6556fe84979deb676abc7c9ee3ce0
Instruction ID: 40a95cd5cee51b934042f51772661ff0e6c4183115e3dba812f0a1b39def4eab
Opcode Fuzzy Hash: 5ad745fddc7de5a9e05b059a4e2e0316d9a6556fe84979deb676abc7c9ee3ce0
Instruction Fuzzy Hash: A55118789047852AFB35D7618810BAABFB48F11381F084699CDD2171C2DA649FCCCBAB

Function 00C5662D Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C56649
GetWindowRect.USER32(00000000,?), ref: 00C56662
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00C566C0
GetDlgItem.USER32(?,00000002), ref: 00C566D0
GetWindowRect.USER32(00000000,?), ref: 00C566E2
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00C56736
GetDlgItem.USER32(?,000003E9), ref: 00C56744
GetWindowRect.USER32(00000000,?), ref: 00C56756
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00C56798
GetDlgItem.USER32(?,000003EA), ref: 00C567AB
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C567C1
InvalidateRect.USER32(?,00000000,00000001), ref: 00C567CE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 40ccf805d5bc3f11a8beed77c3de7662c41d673231f971af32a85f4dab0ae1b2
Instruction ID: 1d14b8f05a2eb2920b864a26ae779403aeadf4f5c357f94ece965c57330df27d
Opcode Fuzzy Hash: 40ccf805d5bc3f11a8beed77c3de7662c41d673231f971af32a85f4dab0ae1b2
Instruction Fuzzy Hash: 66512F75A00209AFDF18CF68CD85BAEBBB5FB48315F508129F91AE7290D770AE44CB54

Function 00BF146D Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BF1488,?,00000000,?,?,?,?,00BF145A,00000000,?), ref: 00BF1865

DestroyWindow.USER32(?), ref: 00BF1521
KillTimer.USER32(00000000,?,?,?,?,00BF145A,00000000,?), ref: 00BF15BB
DestroyAcceleratorTable.USER32(00000000), ref: 00C329B4
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00BF145A,00000000,?), ref: 00C329E2
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00BF145A,00000000,?), ref: 00C329F9
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00BF145A,00000000), ref: 00C32A15
DeleteObject.GDI32(00000000), ref: 00C32A27

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 7e4e43c995e6855d5251c8a3c4efd51e9edb5b6273677f6bf0ec5a416f000f91
Instruction ID: 8d93b2034c2d943ecdb1330e170faba3ac3fb30373cd01c54801bd2b6f6bb57a
Opcode Fuzzy Hash: 7e4e43c995e6855d5251c8a3c4efd51e9edb5b6273677f6bf0ec5a416f000f91
Instruction Fuzzy Hash: 13618931511719DFDB399F18D988B3AB7F1FB90322F108958E14397AA0C771A989EF44

Function 00BF2128 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00BF2234: GetWindowLongW.USER32(?,000000EB), ref: 00BF2242

GetSysColor.USER32(0000000F), ref: 00BF2152

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 406dedb43b1d746930db566ddf8cf52f97156ebe181601e4062e2647c08e020a
Instruction ID: 99d972fa3bb40d7f386dd100dbf26773f2c1567e40744c19219ee05950a8ec95
Opcode Fuzzy Hash: 406dedb43b1d746930db566ddf8cf52f97156ebe181601e4062e2647c08e020a
Instruction Fuzzy Hash: CD41A035100648AFDB205F28DC88BBE37B6EB42735F144695FBA29B2E1C7319E46DB14

Function 00C5A05C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00C40D31,00000001,0000138C,00000001,00000000,00000001,?,00C6EEAE,00CC2430), ref: 00C5A091
LoadStringW.USER32(00000000,?,00C40D31,00000001), ref: 00C5A09A

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00C40D31,00000001,0000138C,00000001,00000000,00000001,?,00C6EEAE,00CC2430,?), ref: 00C5A0BC
LoadStringW.USER32(00000000,?,00C40D31,00000001), ref: 00C5A0BF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C5A1E0

Strings

Line %d:, xrefs: 00C5A11A
Error: , xrefs: 00C5A197
Line %d (File "%s"):, xrefs: 00C5A109
%s (%d) : ==> %s: %s %s, xrefs: 00C5A1C4
^ ERROR, xrefs: 00C5A175

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 55d8318ab812cac9a95db7e7c80b879ec874f520c31306024092aac34d9fd9f3
Instruction ID: d5df3594bc1f6050aaeba206f9b5449f7781bfff7500a05d4f8b62de18549631
Opcode Fuzzy Hash: 55d8318ab812cac9a95db7e7c80b879ec874f520c31306024092aac34d9fd9f3
Instruction Fuzzy Hash: 2D411C7280010DAACB04EBE1DD46EEEB7B8AF54301F5001A5BA05B20A2EB656F4DDB65

Function 00C50FCF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C51093
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C510AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C510CB
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C510F5
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00C5111D
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C51128
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C5112D

Strings

\IPC$, xrefs: 00C51075
\CLSID, xrefs: 00C51015
SOFTWARE\Classes\, xrefs: 00C50FFF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 0e61ccf98309b01aba943b86f7352454bf23e44826cca21fd792237c442d718d
Instruction ID: 305520e1583ca489f2b9e260163b7de890988bdf1818bef0070d1b362988215d
Opcode Fuzzy Hash: 0e61ccf98309b01aba943b86f7352454bf23e44826cca21fd792237c442d718d
Instruction Fuzzy Hash: 0541FA76C1022DABCF15EFA4DC45EEEB7B8BF14750F044169EA11A31A1EB319E48CB54

Function 00C84A34 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00C84AD9
CreateCompatibleDC.GDI32(00000000), ref: 00C84AE0
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00C84AF3
SelectObject.GDI32(00000000,00000000), ref: 00C84AFB
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C84B06
DeleteDC.GDI32(00000000), ref: 00C84B10
GetWindowLongW.USER32(?,000000EC), ref: 00C84B1A
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00C84B30
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00C84B3C

Strings

static, xrefs: 00C84A71

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 0e43e531eb28f84f4f57846805f5cd3328fe778576317e173e1407236098c0ab
Instruction ID: fbd9b3c4b50325c91481a374572b2822617307f41256824b43abf74f48ef8f01
Opcode Fuzzy Hash: 0e43e531eb28f84f4f57846805f5cd3328fe778576317e173e1407236098c0ab
Instruction Fuzzy Hash: 01314D31100219ABDF11AFA4DC08FEE3BA9FF09769F110215FA26961E0C735D950EB58

Function 00C7468D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C746B9
CoInitialize.OLE32(00000000), ref: 00C746E7
CoUninitialize.OLE32 ref: 00C746F1
_wcslen.LIBCMT ref: 00C7478A
GetRunningObjectTable.OLE32(00000000,?), ref: 00C7480E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C74932
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00C7496B
CoGetObject.OLE32(?,00000000,00C90B64,?), ref: 00C7498A
SetErrorMode.KERNEL32(00000000), ref: 00C7499D
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C74A21
VariantClear.OLEAUT32(?), ref: 00C74A35

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: ea8c24af30c20bf4561a509527d8efeef564e7b62e726e14fd1106307ab35c18
Instruction ID: 238290f58fed0231b22afb2d5ed2f016d342960bb4f8833cccaf280766733271
Opcode Fuzzy Hash: ea8c24af30c20bf4561a509527d8efeef564e7b62e726e14fd1106307ab35c18
Instruction Fuzzy Hash: 5BC133716042059FC704DF68C88492BBBE9FF89748F10895DF99ADB260DB31ED45CB92

Function 00C684DB Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C68538
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C685D4
SHGetDesktopFolder.SHELL32(?), ref: 00C685E8
CoCreateInstance.OLE32(00C90CD4,00000000,00000001,00CB7E8C,?), ref: 00C68634
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C686B9
CoTaskMemFree.OLE32(?,?), ref: 00C68711
SHBrowseForFolderW.SHELL32(?), ref: 00C6879C
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C687BF
CoTaskMemFree.OLE32(00000000), ref: 00C687C6
CoTaskMemFree.OLE32(00000000), ref: 00C6881B
CoUninitialize.OLE32 ref: 00C68821

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 4038958a8eb53c7e551955907aa2d57b94b347dad9b570f60b02228e50be9898
Instruction ID: 0a80e6110871f0aed3843fd0440adc2314c4d370cd4ff45a3f7f69cc47bd2d1b
Opcode Fuzzy Hash: 4038958a8eb53c7e551955907aa2d57b94b347dad9b570f60b02228e50be9898
Instruction Fuzzy Hash: E2C1FB75A00119AFDB14DFA4C888DAEBBF5FF48304B148599F51ADB2A1DB30EE45CB90

Function 00C50378 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00C5039F
SafeArrayAllocData.OLEAUT32(?), ref: 00C503F8
VariantInit.OLEAUT32(?), ref: 00C5040A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C5042A
VariantCopy.OLEAUT32(?,?), ref: 00C5047D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C50491
VariantClear.OLEAUT32(?), ref: 00C504A6
SafeArrayDestroyData.OLEAUT32(?), ref: 00C504B3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C504BC
VariantClear.OLEAUT32(?), ref: 00C504CE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C504D9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 9c451886c4b4c00896337ac3555b2e6a49be36963c62c15128e12baf5a64f9f1
Instruction ID: 13a4a82716f45e08d2ffb164354a1b218464b8368fc8673284d09188808ffed3
Opcode Fuzzy Hash: 9c451886c4b4c00896337ac3555b2e6a49be36963c62c15128e12baf5a64f9f1
Instruction Fuzzy Hash: 16416375A00219DFCF10DFA4D844AAEBBB9FF48355F108069F916E7261C730A985CF94

Function 00C5A635 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C5A65D
GetAsyncKeyState.USER32(000000A0), ref: 00C5A6DE
GetKeyState.USER32(000000A0), ref: 00C5A6F9
GetAsyncKeyState.USER32(000000A1), ref: 00C5A713
GetKeyState.USER32(000000A1), ref: 00C5A728
GetAsyncKeyState.USER32(00000011), ref: 00C5A740
GetKeyState.USER32(00000011), ref: 00C5A752
GetAsyncKeyState.USER32(00000012), ref: 00C5A76A
GetKeyState.USER32(00000012), ref: 00C5A77C
GetAsyncKeyState.USER32(0000005B), ref: 00C5A794
GetKeyState.USER32(0000005B), ref: 00C5A7A6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 078d648d906460fe054a2d94c9a3ffe9ac90fb7c59693ed438f42038a2f34f2e
Instruction ID: 30e812978f527026057f30617e5edf34cd4dab1625dac74cfe8c2975d715b4bb
Opcode Fuzzy Hash: 078d648d906460fe054a2d94c9a3ffe9ac90fb7c59693ed438f42038a2f34f2e
Instruction Fuzzy Hash: 4941F87C5047C96DFF31466284047A5BEB06F15385F08825ADDE64A1C2EBA49FCCCB6B

Function 00C79730 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00C79750

Part of subcall function 00C59805: _wcslen.LIBCMT ref: 00C59828

_wcslen.LIBCMT ref: 00C797AB
_wcslen.LIBCMT ref: 00C797F9
_wcslen.LIBCMT ref: 00C79839
_wcslen.LIBCMT ref: 00C798CB

Strings

none, xrefs: 00C798C2, 00C798C7
cdecl, xrefs: 00C797A5, 00C797AA
winapi, xrefs: 00C797F3, 00C797F8
stdcall, xrefs: 00C79833, 00C79838

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: fc544a916094acfebfb6f862b04e2e9f07a9c9b77b32d41bd239d6b5711b7aef
Instruction ID: 209bd57b0624d1ed553c9ed83c4559b0904aee5b17c90e7a25fdb483e9ababaf
Opcode Fuzzy Hash: fc544a916094acfebfb6f862b04e2e9f07a9c9b77b32d41bd239d6b5711b7aef
Instruction Fuzzy Hash: 0651B171A0011A9BCF14DFA8C9519BEB7A5FF65360B208229E93AE72C4DB31DE41C791

Function 00C74189 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00C741D1
CoUninitialize.OLE32 ref: 00C741DC
CoCreateInstance.OLE32(?,00000000,00000017,00C90B44,?), ref: 00C74236
IIDFromString.OLE32(?,?), ref: 00C742A9
VariantInit.OLEAUT32(?), ref: 00C74341
VariantClear.OLEAUT32(?), ref: 00C74393

Strings

Invalid parameter, xrefs: 00C742C2
Failed to create object, xrefs: 00C74241, 00C742F7
NULL Pointer assignment, xrefs: 00C7427B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 15ae326b0833475d93c17d7d27143684c7f54293b5ee9328071716e75b566cc0
Instruction ID: 0ebdd436be14f6c12d1dfaac26a8a49ca713de89e9afacf7b8ed870a0b8fbbca
Opcode Fuzzy Hash: 15ae326b0833475d93c17d7d27143684c7f54293b5ee9328071716e75b566cc0
Instruction Fuzzy Hash: 4761A1716087019FC314DF65C888F6EBBE8EF49714F108959F999972A2C770ED48CB92

Function 00C68BDA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C68C9C
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C68CAC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C68CB8
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C68D55
SetCurrentDirectoryW.KERNEL32(?), ref: 00C68D69
SetCurrentDirectoryW.KERNEL32(?), ref: 00C68D9B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C68DD1
SetCurrentDirectoryW.KERNEL32(?), ref: 00C68DDA

Strings

*.*, xrefs: 00C68DE0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 6a753a7dac782c999dec25e819d92b9566d71a36f46f6893c4cb2ffc95063fbd
Instruction ID: aeae85d71648d25f7b0a0accf7a1940f6b204f7cd202cb2a4b7c886c5395676b
Opcode Fuzzy Hash: 6a753a7dac782c999dec25e819d92b9566d71a36f46f6893c4cb2ffc95063fbd
Instruction Fuzzy Hash: 8D617271504305AFCB10EF60C8849AEB7E8FF99310F04495DF999C7291DB31E949CB52

Function 00C846E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00C84715
SetMenu.USER32(?,00000000), ref: 00C84724
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C847AC
IsMenu.USER32(?), ref: 00C847C0
CreatePopupMenu.USER32 ref: 00C847CA
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C847F7
DrawMenuBar.USER32 ref: 00C847FF

Strings

F, xrefs: 00C847EA
0, xrefs: 00C846F0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: a90905d1835a8141c99b68179cd43b85f5e68b8bb9a5465e515a4ba040fd52cc
Instruction ID: 040853b788459a347529d5abc7c7da860fd55297fc8447499d645799b4a9c54a
Opcode Fuzzy Hash: a90905d1835a8141c99b68179cd43b85f5e68b8bb9a5465e515a4ba040fd52cc
Instruction Fuzzy Hash: CE417AB5A0120AEFDB18EF64D844FAE7BB5FF09318F144029FA5697390D770AA14CB54

Function 00C5282C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00C528B1
GetDlgCtrlID.USER32 ref: 00C528BC
GetParent.USER32 ref: 00C528D8
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C528DB
GetDlgCtrlID.USER32(?), ref: 00C528E4
GetParent.USER32(?), ref: 00C528F8
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C528FB

Strings

ListBox, xrefs: 00C5286E
ComboBox, xrefs: 00C52839

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 1b1b3d56e14e0da57dc739bf8c06f1d62d077286d2f57318ad7c520b3a1223d5
Instruction ID: d57564f32ce3e1125af059619eaa4dbdf292ee8f9019937e8fd1f7995efb13f4
Opcode Fuzzy Hash: 1b1b3d56e14e0da57dc739bf8c06f1d62d077286d2f57318ad7c520b3a1223d5
Instruction Fuzzy Hash: 9A21C279900118BBCF04AFA0CC85EFEBBB8EF06311F000156B962A32D1DB35598CDB68

Function 00C5290D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00C52990
GetDlgCtrlID.USER32 ref: 00C5299B
GetParent.USER32 ref: 00C529B7
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C529BA
GetDlgCtrlID.USER32(?), ref: 00C529C3
GetParent.USER32(?), ref: 00C529D7
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C529DA

Strings

ListBox, xrefs: 00C5294F
ComboBox, xrefs: 00C5291A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 37d1380eb3aee589b5b19b0441a4a34cd3c235bb332287993e619dd05786f77e
Instruction ID: 764b65ad6bda3b3a092e89d88f70936abf9a7abaa285ed463ffb2dcc404c52a9
Opcode Fuzzy Hash: 37d1380eb3aee589b5b19b0441a4a34cd3c235bb332287993e619dd05786f77e
Instruction Fuzzy Hash: 8921A1B9900118BBCF05AFA0CC85FFEBBB8EF05311F004456B952A7295DB79498DDB68

Function 00C844BF Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C84539
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C8453C
GetWindowLongW.USER32(?,000000F0), ref: 00C84563
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C84586
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C845FE
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00C84648
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00C84663
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00C8467E
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00C84692
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00C846AF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 81563bd5daff3a32cea1a391728769b55444ee57b74271049c72953a341b1019
Instruction ID: c8d2b250ad916b465d9380ebaae06c3b97af081ff6dfe4d8fd406f96bcfc9689
Opcode Fuzzy Hash: 81563bd5daff3a32cea1a391728769b55444ee57b74271049c72953a341b1019
Instruction Fuzzy Hash: DC617C75A00209AFDB14EFA4CC81FEE77B8EF09714F100169FA14E72A1D774AA45DB54

Function 00C5BAF6 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C5BB18
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BB2C
GetWindowThreadProcessId.USER32(00000000), ref: 00C5BB33
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BB42
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C5BB54
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BB6D
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BB7F
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BBC4
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BBD9
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00C5ABA8,?,00000001), ref: 00C5BBE4

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d308bdfc537cde8fcb5b8a7a246f019a16afef81cb5b3f80b2c49e83ed2efa99
Instruction ID: 097d23e107a4e7470b43f4628897691396fb523aa188d9fb81f5c428577efd22
Opcode Fuzzy Hash: d308bdfc537cde8fcb5b8a7a246f019a16afef81cb5b3f80b2c49e83ed2efa99
Instruction Fuzzy Hash: 733191BA904208AFDB249B14EC98F6D7BB9EB44313F108005FE16D71E4D7B49E848B28

Function 00C22FF3 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C23007

Part of subcall function 00C22D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4), ref: 00C22D4E
Part of subcall function 00C22D38: GetLastError.KERNEL32(00CC1DC4,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4,00CC1DC4), ref: 00C22D60

_free.LIBCMT ref: 00C23013
_free.LIBCMT ref: 00C2301E
_free.LIBCMT ref: 00C23029
_free.LIBCMT ref: 00C23034
_free.LIBCMT ref: 00C2303F
_free.LIBCMT ref: 00C2304A
_free.LIBCMT ref: 00C23055
_free.LIBCMT ref: 00C23060
_free.LIBCMT ref: 00C2306E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4ad85dc9c53dc35f6a0e3341e460ba5b9e11c0f3938fb2e9da2d75f0bcaf4b30
Instruction ID: 0a0256e58aebaf4209ad41cd292ded38c553ce954b47d03485350855bc435869
Opcode Fuzzy Hash: 4ad85dc9c53dc35f6a0e3341e460ba5b9e11c0f3938fb2e9da2d75f0bcaf4b30
Instruction Fuzzy Hash: 7B11A276140118BFCB01EF94E842CDD3BA5EF09350FC144A5FA089BA22DA32EA51EF90

Function 00BF2AB0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00BF2AF9
OleUninitialize.OLE32(?,00000000), ref: 00BF2B98
UnregisterHotKey.USER32(?), ref: 00BF2D7D
DestroyWindow.USER32(?), ref: 00C33A1B
FreeLibrary.KERNEL32(?), ref: 00C33A80
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00C33AAD

Strings

close all, xrefs: 00BF2AF4

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 02e458d8cb0f4f3de8eeeb7a74087a252018d8c12241bf68ab7a8d8f734ed21d
Instruction ID: 43823c24ae4b0364a2dc16e198d0150774fbe36a0c7629a4b3ef55b6c5b99933
Opcode Fuzzy Hash: 02e458d8cb0f4f3de8eeeb7a74087a252018d8c12241bf68ab7a8d8f734ed21d
Instruction Fuzzy Hash: DAD17B31711252DFCB29EF54C885A69F7A0FF04714F1142EDE94AAB2A2CB30AE56DF44

Function 00C68835 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C689F2
SetCurrentDirectoryW.KERNEL32(?), ref: 00C68A06
GetFileAttributesW.KERNEL32(?), ref: 00C68A30
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C68A4A
SetCurrentDirectoryW.KERNEL32(?), ref: 00C68A5C
SetCurrentDirectoryW.KERNEL32(?), ref: 00C68AA5
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C68AF5

Strings

*.*, xrefs: 00C68AAB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 15ab3beabb872437f5e0e9ccec569893acf494d169544ab709d8f50a27daced6
Instruction ID: bb26ea9ac3eeb14d245dce42f67774584c54a6c776761166aeb1a105a20f07cb
Opcode Fuzzy Hash: 15ab3beabb872437f5e0e9ccec569893acf494d169544ab709d8f50a27daced6
Instruction Fuzzy Hash: BD81D1719083049BCB34EF54C494ABEB3E8BF88310F584A1AF995D7291DF34DA49DB92

Function 00BF7447 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00BF74D7

Part of subcall function 00BF7567: GetClientRect.USER32(?,?), ref: 00BF758D
Part of subcall function 00BF7567: GetWindowRect.USER32(?,?), ref: 00BF75CE
Part of subcall function 00BF7567: ScreenToClient.USER32(?,?), ref: 00BF75F6

GetDC.USER32 ref: 00C36083
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00C36096
SelectObject.GDI32(00000000,00000000), ref: 00C360A4
SelectObject.GDI32(00000000,00000000), ref: 00C360B9
ReleaseDC.USER32(?,00000000), ref: 00C360C1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00C36152

Strings

U, xrefs: 00C36021

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 863de6543ff812949a1757269dbe8c0c41c356210fb0d1df16f575e0cbdec582
Instruction ID: 7fae53aa2b966528c113d534c661f540d77ccaddd4f4a1f403e739f94462d109
Opcode Fuzzy Hash: 863de6543ff812949a1757269dbe8c0c41c356210fb0d1df16f575e0cbdec582
Instruction Fuzzy Hash: 9D71BE31500209EFCF259F64C885ABE7BB5FF48320F1486A9ED665B2A6C7318944EF50

Function 00C8955E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

Part of subcall function 00BF19CD: GetCursorPos.USER32(?), ref: 00BF19E1
Part of subcall function 00BF19CD: ScreenToClient.USER32(00000000,?), ref: 00BF19FE
Part of subcall function 00BF19CD: GetAsyncKeyState.USER32(00000001), ref: 00BF1A23
Part of subcall function 00BF19CD: GetAsyncKeyState.USER32(00000002), ref: 00BF1A3D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 00C895C7
ImageList_EndDrag.COMCTL32 ref: 00C895CD
ReleaseCapture.USER32 ref: 00C895D3
SetWindowTextW.USER32(?,00000000), ref: 00C8966E
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C89681
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 00C8975B

Strings

@GUI_DROPID, xrefs: 00C896AD
@GUI_DRAGFILE, xrefs: 00C896F6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 6674735e155040029952d85fd8bfa054bf4213db4fde1dbeb220a8d7d825cbfd
Instruction ID: cab50d7913ba19c1c2dac82bd39c296d22cdbbc8317ae07fd0a3d6cb9faddc28
Opcode Fuzzy Hash: 6674735e155040029952d85fd8bfa054bf4213db4fde1dbeb220a8d7d825cbfd
Instruction Fuzzy Hash: 74516670204304AFD704EF24CC56FBA77E4EB88714F400A69FA96972E2DB709A08DB56

Function 00C6CC98 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C6CCB7
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C6CCDF
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C6CD0F
GetLastError.KERNEL32 ref: 00C6CD67
SetEvent.KERNEL32(?), ref: 00C6CD7B
InternetCloseHandle.WININET(00000000), ref: 00C6CD86

Strings

, xrefs: 00C6CD00

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: a028adc491412bcdd8e3065330657e978f2b9fe6e7c801058fcac1644be07889
Instruction ID: 19e283511daabd78bd1be784679f79c8133842bcab384c3ce5a29c548f65943f
Opcode Fuzzy Hash: a028adc491412bcdd8e3065330657e978f2b9fe6e7c801058fcac1644be07889
Instruction Fuzzy Hash: 21315C71600204AFD731AF6598C8BBB7BBCEB45740B10452AF496D2240DB34ED049BA4

Function 00C5A215 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00C355AE,?,?,Bad directive syntax error,00C8DCD0,00000000,00000010,?,?), ref: 00C5A236
LoadStringW.USER32(00000000,?,00C355AE,?), ref: 00C5A23D

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00C5A301

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 00C5A26B
Line %d:, xrefs: 00C5A28C
., xrefs: 00C5A2E7
Line %d (File "%s"):, xrefs: 00C5A2A7
Error: , xrefs: 00C5A2CF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: b6e8955b172afd9451fc01d968224c07beaf190059e3f6281ffddbd05845ce0b
Instruction ID: 3cfd90cf0bd17c7f50358b456543ed4159fd374a660fd11e7ffb4bb20c450ae0
Opcode Fuzzy Hash: b6e8955b172afd9451fc01d968224c07beaf190059e3f6281ffddbd05845ce0b
Instruction Fuzzy Hash: CF214F3184021EAFCF15AFA0CC0AEEE7B79BF18700F044569BA15660A2EB719658DB15

Function 00C529EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C529F8
GetClassNameW.USER32(00000000,?,00000100), ref: 00C52A0D
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C52A9A

Strings

smallicons, xrefs: 00C52A62
SHELLDLL_DefView, xrefs: 00C52A19
details, xrefs: 00C52A48
largeicons, xrefs: 00C52A2E
list, xrefs: 00C52A7C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 4953df3b83067ed3f2072627357f4b4ac57ccc0f69771218bad8981d4a53ce00
Instruction ID: bee82d030ca601031609288e3e240d631e57dc2590695dcab64bedbe23939763
Opcode Fuzzy Hash: 4953df3b83067ed3f2072627357f4b4ac57ccc0f69771218bad8981d4a53ce00
Instruction Fuzzy Hash: A511067A244307BAFA287621EC07EEA77ECCF16725F200022FD05E50D1FB65A9C47618

Function 00BF7567 Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BF758D
GetWindowRect.USER32(?,?), ref: 00BF75CE
ScreenToClient.USER32(?,?), ref: 00BF75F6
GetClientRect.USER32(?,?), ref: 00BF773A
GetWindowRect.USER32(?,?), ref: 00BF775B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 5803451f07e9b989bb0f8d7d702f8b4c53e6e24c2e89b5a009b01eac07297ba4
Instruction ID: 20f0d735475d363ebbe5d11d03c95d76813bff50f8006a8957e2335e01476308
Opcode Fuzzy Hash: 5803451f07e9b989bb0f8d7d702f8b4c53e6e24c2e89b5a009b01eac07297ba4
Instruction Fuzzy Hash: 43C1693891464AEBDB10CFA8C480BFEB7F1FF18310F14845AE9A5E3250DB34AA54DB60

Function 00C2D210 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00C2D237
_free.LIBCMT ref: 00C2D2A2
_free.LIBCMT ref: 00C2D2C8
_free.LIBCMT ref: 00C2D2F1
_free.LIBCMT ref: 00C2D329
_free.LIBCMT ref: 00C2D35A
_free.LIBCMT ref: 00C2D39B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00C2D41C
_free.LIBCMT ref: 00C2D435

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 7e7e1cf9ae23df58c62aae153ebef929e2e1d1bbdf79a6a795ca32264fde60c7
Instruction ID: 5cbc1993f7f4db5727a09f24122c9d1254b7e360801ddc204707991d288c2aa1
Opcode Fuzzy Hash: 7e7e1cf9ae23df58c62aae153ebef929e2e1d1bbdf79a6a795ca32264fde60c7
Instruction Fuzzy Hash: 41614971904330EFDB22EF75F881BAD7BA49F22320F14016DF857A7A92D6319E409B91

Function 00C85B72 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00C85C24
ShowWindow.USER32(?,00000000), ref: 00C85C65
ShowWindow.USER32(?,00000005,?,00000000), ref: 00C85C6B
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00C85C6F

Part of subcall function 00C879F2: DeleteObject.GDI32(00000000), ref: 00C87A1E

GetWindowLongW.USER32(?,000000F0), ref: 00C85CAB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C85CB8
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C85CEB
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00C85D25
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00C85D34

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 295edfdaccf0deaf41072b2eb9526f94baa7dd97438e4cf0276f87aff91f242e
Instruction ID: 9a8a3247f75c7a1e2b293fcb98fe9c414e09945bbf83548d83468eb0a2d2dea6
Opcode Fuzzy Hash: 295edfdaccf0deaf41072b2eb9526f94baa7dd97438e4cf0276f87aff91f242e
Instruction Fuzzy Hash: 4B519430640A08BFEF24AF15CC49FA93BA5FB04758F144112FA259A1E1C7F69A90DF49

Function 00BF13A6 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00C328D1
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00C328EA
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00C328FA
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00C32912
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00C32933
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BF11F5,00000000,00000000,00000000,000000FF,00000000), ref: 00C32942
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00C3295F
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BF11F5,00000000,00000000,00000000,000000FF,00000000), ref: 00C3296E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 4cb00d671c6207ef0d356d47ba2bfa755d35c90c59f3aeea0d31d7d77940ee16
Instruction ID: b91c865a0dc5bdc4682508b388ce282bbc50932f691ee02c6e7679de136a0d52
Opcode Fuzzy Hash: 4cb00d671c6207ef0d356d47ba2bfa755d35c90c59f3aeea0d31d7d77940ee16
Instruction Fuzzy Hash: A7515870610309EFDB24DF29CC85BAA7BF5EB88720F104958FA52976E0D770E994EB50

Function 00C6CB88 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C6CBC7
GetLastError.KERNEL32 ref: 00C6CBDA
SetEvent.KERNEL32(?), ref: 00C6CBEE

Part of subcall function 00C6CC98: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C6CCB7
Part of subcall function 00C6CC98: GetLastError.KERNEL32 ref: 00C6CD67
Part of subcall function 00C6CC98: SetEvent.KERNEL32(?), ref: 00C6CD7B
Part of subcall function 00C6CC98: InternetCloseHandle.WININET(00000000), ref: 00C6CD86

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 2918673b9747b6b509081b722daf39a42b10775dee835ade81ba168ce54695a0
Instruction ID: a3a900025505b0930263461d3bbeecd06fc9828f3481751cdc8f2c8c46d305d7
Opcode Fuzzy Hash: 2918673b9747b6b509081b722daf39a42b10775dee835ade81ba168ce54695a0
Instruction Fuzzy Hash: 08316971601705BFDB319FA5DDC4B7ABBB8FF48300B04452DF9AA82650CB31E914ABA0

Function 00C52EEF Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C54393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C543AD
Part of subcall function 00C54393: GetCurrentThreadId.KERNEL32 ref: 00C543B4
Part of subcall function 00C54393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C52F00), ref: 00C543BB

MapVirtualKeyW.USER32(00000025,00000000), ref: 00C52F0A
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00C52F28
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00C52F2C
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C52F36
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00C52F4E
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00C52F52
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C52F5C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00C52F70
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00C52F74

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 699b701532a589799da580f0d49109b16f0834c55b60ea2b520f77a68209cf2c
Instruction ID: 09301d8e16f23b3922e29bc634bf51e6743f1f5fbc5e8bb76adddb162a8d15ce
Opcode Fuzzy Hash: 699b701532a589799da580f0d49109b16f0834c55b60ea2b520f77a68209cf2c
Instruction Fuzzy Hash: D501B5306842147BFB106B699C8EF5D3F59DF4EB12F100011F719AE1E4C9E164849BAD

Function 00C52150 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00C51D95,?,?,00000000), ref: 00C52159
HeapAlloc.KERNEL32(00000000,?,00C51D95,?,?,00000000), ref: 00C52160
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C51D95,?,?,00000000), ref: 00C52175
GetCurrentProcess.KERNEL32(?,00000000,?,00C51D95,?,?,00000000), ref: 00C5217D
DuplicateHandle.KERNEL32(00000000,?,00C51D95,?,?,00000000), ref: 00C52180
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C51D95,?,?,00000000), ref: 00C52190
GetCurrentProcess.KERNEL32(00C51D95,00000000,?,00C51D95,?,?,00000000), ref: 00C52198
DuplicateHandle.KERNEL32(00000000,?,00C51D95,?,?,00000000), ref: 00C5219B
CreateThread.KERNEL32(00000000,00000000,00C521C1,00000000,00000000,00000000), ref: 00C521B5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bc1967ca6a350d4981119ec3ab3996b9deff26f6e2582f574c7553bd0b323857
Instruction ID: 2d4870029922c93d6f12e80c7e667b9cd9944e51a15b4a1436bac4503e3abcd9
Opcode Fuzzy Hash: bc1967ca6a350d4981119ec3ab3996b9deff26f6e2582f574c7553bd0b323857
Instruction Fuzzy Hash: 8201A8B5240304BFE610ABA5EC8DF6F7BACEB89711F004411FA05DB1E1CA709C04CB24

Function 00C7AB3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00C5DD87: CreateToolhelp32Snapshot.KERNEL32 ref: 00C5DDAC
Part of subcall function 00C5DD87: Process32FirstW.KERNEL32(00000000,?), ref: 00C5DDBA
Part of subcall function 00C5DD87: CloseHandle.KERNEL32(00000000), ref: 00C5DE87

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C7ABCA
GetLastError.KERNEL32 ref: 00C7ABDD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C7AC10
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C7ACC5
GetLastError.KERNEL32(00000000), ref: 00C7ACD0
CloseHandle.KERNEL32(00000000), ref: 00C7AD21

Strings

SeDebugPrivilege, xrefs: 00C7ABEC

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4ef25de1dabf27bb9aadb014d28d17801ab576771ee844f88521a6a9e46a2ab6
Instruction ID: 1c7c74e3123a20f590444f47eeab44912a32613381fc54d7b600acd7532a7b28
Opcode Fuzzy Hash: 4ef25de1dabf27bb9aadb014d28d17801ab576771ee844f88521a6a9e46a2ab6
Instruction Fuzzy Hash: DE619074204242AFD321DF15C495F29BBE1AF94318F14C49CE46A8B7A3C772ED49CB92

Function 00C84322 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C843C1
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00C843D6
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C843F0
_wcslen.LIBCMT ref: 00C84435
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C84462
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C84490

Strings

SysListView32, xrefs: 00C84393

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 6dab1739a877a4a31cc5006bad49575d0b66a8c9ec86d2201bb8460ee99d1119
Instruction ID: 8ed74177c2bdedd797f5c95bee3de87c310f2db90cda7a2e69a4358470cc82b6
Opcode Fuzzy Hash: 6dab1739a877a4a31cc5006bad49575d0b66a8c9ec86d2201bb8460ee99d1119
Instruction Fuzzy Hash: 5441D071900319ABDF25AFA4CC49FEE7BA9FF48364F100126F914E7291D7709980DB94

Function 00C5C625 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C5C6C4
IsMenu.USER32(00000000), ref: 00C5C6E4
CreatePopupMenu.USER32 ref: 00C5C71A
GetMenuItemCount.USER32(01156C08), ref: 00C5C76B
InsertMenuItemW.USER32(01156C08,?,00000001,00000030), ref: 00C5C793

Strings

0, xrefs: 00C5C66F
2, xrefs: 00C5C6FE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: a53a0c43a0c5ef5f87c9b36251778008edcc672243349be8162e4e1c16dfe425
Instruction ID: 405804139c5dabfd25be1fe1f7f656880241211f458cffb8f3a753cf67f91915
Opcode Fuzzy Hash: a53a0c43a0c5ef5f87c9b36251778008edcc672243349be8162e4e1c16dfe425
Instruction Fuzzy Hash: 2651B2786003059FDF10CF68D8C4BAEBBF4AF58399F24415AEC2197691E7709A88CF59

Function 00C5D11F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C5D1BE

Strings

blank, xrefs: 00C5D140
info, xrefs: 00C5D15F
warning, xrefs: 00C5D1A7
stop, xrefs: 00C5D18F
question, xrefs: 00C5D177

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 69cae5e87ed8efb722ba5b45a2fd2351e9553ff2c37622f92c7f4daf2e5634b5
Instruction ID: 70ca3b846d4663dfa13297ff2f20d4a943dc117bc90e05d8a00dbcf8e59f413d
Opcode Fuzzy Hash: 69cae5e87ed8efb722ba5b45a2fd2351e9553ff2c37622f92c7f4daf2e5634b5
Instruction Fuzzy Hash: 2B11E739248706BAEB156B55EC82DEF779CDF05771F20006AFD02B62C1DBB45BC45268

Function 00C5E73E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C5E759
gethostname.WSOCK32(?,00000100), ref: 00C5E773
gethostbyname.WSOCK32(?), ref: 00C5E780
inet_ntoa.WSOCK32(?), ref: 00C5E7C2
_strcat.LIBCMT ref: 00C5E7D0
WSACleanup.WSOCK32 ref: 00C5E7F5

Strings

0.0.0.0, xrefs: 00C5E79E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: ec18f4deb8630ee362f0347fb72202fead9000b2451b487006de4c2ac5208a1a
Instruction ID: cef7bbd347b598ee349839ed300cf0033ff8ca60825f1cf07bc97bb080496ff0
Opcode Fuzzy Hash: ec18f4deb8630ee362f0347fb72202fead9000b2451b487006de4c2ac5208a1a
Instruction Fuzzy Hash: F411D2759001147BDB286B209C4AFEE77ACEF05712F1000A9F916E60D1EE748BC5E798

Function 00C5F630 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C5F641
_wcslen.LIBCMT ref: 00C5F652
_wcslen.LIBCMT ref: 00C5F690
_wcslen.LIBCMT ref: 00C5F6C6
_wcslen.LIBCMT ref: 00C5F6F6
_wcslen.LIBCMT ref: 00C5F706
_wcslen.LIBCMT ref: 00C5F742
_wcslen.LIBCMT ref: 00C5F771

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: e16f70af46f7840522027a6d2d2905870f23467099446f44c951072e027dd914
Instruction ID: ef652afd61ae9c2580eed28f5b2dfd812e2c1954860d37cc83422d8b4de3015c
Opcode Fuzzy Hash: e16f70af46f7840522027a6d2d2905870f23467099446f44c951072e027dd914
Instruction Fuzzy Hash: 6841D565C10114B5CB15EBB8CC86ACFB3ACAF06350F008426F519E3121FA34D2D6E7EA

Function 00C0FBC6 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00C339E2,00000004,00000000,00000000), ref: 00C0FC41
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00C339E2,00000004,00000000,00000000), ref: 00C4FC15
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00C339E2,00000004,00000000,00000000), ref: 00C4FC98

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 2c06a8d4380f188cb59c429fb7ed8348d1c96f12d4376c40515209633552a08d
Instruction ID: 281a3cdcb85e51f8f4e1d91260b453280deddaeb9f2836d2c0d1280dcbc820f6
Opcode Fuzzy Hash: 2c06a8d4380f188cb59c429fb7ed8348d1c96f12d4376c40515209633552a08d
Instruction Fuzzy Hash: A741F73160838C9AE7358B39C9CDB2E7F91BB46710F14453CE96746EE0C671AAC2D711

Function 00C8379F Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C837B7
GetDC.USER32(00000000), ref: 00C837BF
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C837CA
ReleaseDC.USER32(00000000,00000000), ref: 00C837D6
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C83812
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C83823
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C86504,?,?,000000FF,00000000,?,000000FF,?), ref: 00C8385E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C8387D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: ec988b551dcda1dd02bee353bdc21203212505f5cc8ded1bd63f742948ca4891
Instruction ID: 800b5c35682f74dd1a3c12abb4b542250f28b6d6a0ae0f85301a85ea316b11dc
Opcode Fuzzy Hash: ec988b551dcda1dd02bee353bdc21203212505f5cc8ded1bd63f742948ca4891
Instruction Fuzzy Hash: 8531CE72200224BFEB118F50DC89FEB3BADEF09B25F040025FE099A2D1D6B59D41C7A8

Function 00C75A0B Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00C75A8B, 00C75DE0
Not an Object type, xrefs: 00C75A64

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 0cfddbf39c884750f64a642ac50da4732172409dd1e7ac7d386619ba8b700894
Instruction ID: 33ffac5e265370d8bdae02ab4c8e4c55b1108fae53a620a772ee73e2bc65ac64
Opcode Fuzzy Hash: 0cfddbf39c884750f64a642ac50da4732172409dd1e7ac7d386619ba8b700894
Instruction Fuzzy Hash: A2D1A075A0060A9FDF10CF68C885BAEB7B5FF48344F14C569E919AB281E7B0EE45CB50

Function 00C318A2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00C31B7B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00C3194E
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00C31B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00C319D1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00C31B7B,?,00C31B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00C31A64
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00C31B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00C31A7B

Part of subcall function 00C23B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00C16A79,?,0000015D,?,?,?,?,00C185B0,000000FF,00000000,?,?), ref: 00C23BC5

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00C31B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00C31AF7
__freea.LIBCMT ref: 00C31B22
__freea.LIBCMT ref: 00C31B2E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: ea5fbf245e0dadbf2d67bee135ae2279b64fedcf61856aa6e9bcc25bd670e4f0
Instruction ID: 5d21fd32287496ef7b570b630489301d0a5118d263ace5c6eb57d01985e7f2f1
Opcode Fuzzy Hash: ea5fbf245e0dadbf2d67bee135ae2279b64fedcf61856aa6e9bcc25bd670e4f0
Instruction Fuzzy Hash: E091C472E202569FDB208E65CC91BEEBBB59F09314F1C0569EC15E7280EB35DE41D760

Function 00C74F80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C750A5
VariantInit.OLEAUT32(?), ref: 00C751A6
VariantClear.OLEAUT32(?), ref: 00C751B0
VariantClear.OLEAUT32(?), ref: 00C7520D

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00C75189
Null Object assignment in FOR..IN loop, xrefs: 00C75035, 00C75163, 00C7521B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: bffce419247ae937ea597c7f428c3a6c5ad3b3e91c303d4ac08cf74f928b4598
Instruction ID: 56071f2f6b45150aa46b13b8d7278e4f805826dfed5ce2eb9e122d10c3736aa8
Opcode Fuzzy Hash: bffce419247ae937ea597c7f428c3a6c5ad3b3e91c303d4ac08cf74f928b4598
Instruction Fuzzy Hash: 0891A171A00619ABDF20CFA5CC48FEEBBB8EF45715F108559F519AB280D7B09A45CFA0

Function 00C61B46 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00C61C1B
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C61C43
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00C61C67
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C61C97
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C61D1E
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C61D83
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C61DEF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 0ba11453c12c92e726760c35923a65617438c8f6310eb010b032719dfe7d641e
Instruction ID: 5f6032a226f032b085b91c971326982e99a6ea57ef9d51fdb0d34ea05d658f06
Opcode Fuzzy Hash: 0ba11453c12c92e726760c35923a65617438c8f6310eb010b032719dfe7d641e
Instruction Fuzzy Hash: B491EE71A00219AFDB219F99C8C4BBEB7B4FF44712F2C4029E911EB2A1D774A941DB90

Function 00C743A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C743C8
CharUpperBuffW.USER32(?,?), ref: 00C744D7
_wcslen.LIBCMT ref: 00C744E7
VariantClear.OLEAUT32(?), ref: 00C7467C

Part of subcall function 00C6169E: VariantInit.OLEAUT32(00000000), ref: 00C616DE
Part of subcall function 00C6169E: VariantCopy.OLEAUT32(?,?), ref: 00C616E7
Part of subcall function 00C6169E: VariantClear.OLEAUT32(?), ref: 00C616F3

Strings

Incorrect Parameter format, xrefs: 00C74403, 00C745FE
AUTOIT.ERROR, xrefs: 00C744DD, 00C744E2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 8d5aca4bd32fba54276a6b490ab0cfae4d5fa32d10059534aa693cf9e36a5901
Instruction ID: 2cb09b7bb9063508598fc5305e9f47cd6f5636ca6a7f8ae9bdc7f28d4e1b5aaa
Opcode Fuzzy Hash: 8d5aca4bd32fba54276a6b490ab0cfae4d5fa32d10059534aa693cf9e36a5901
Instruction Fuzzy Hash: 20916A74A083059FC704EF24C48096AB7E5FF89714F14896DF89A9B351DB31EE4ADB82

Function 00C7560A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00C508FE: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?,?,00C50C4E), ref: 00C5091B
Part of subcall function 00C508FE: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?), ref: 00C50936
Part of subcall function 00C508FE: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?), ref: 00C50944
Part of subcall function 00C508FE: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?), ref: 00C50954

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00C756AE
_wcslen.LIBCMT ref: 00C757B6
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00C7582C
CoTaskMemFree.OLE32(?), ref: 00C75837

Strings

NULL Pointer assignment, xrefs: 00C75880, 00C758AF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 202dc3983f82e35fd064bdb254e32fb6b36d7b9be08f197d0d18c2d60d647adf
Instruction ID: 12ef31e34907126db62b505a72df09496d38f81784e936a6d649abc58d91a10c
Opcode Fuzzy Hash: 202dc3983f82e35fd064bdb254e32fb6b36d7b9be08f197d0d18c2d60d647adf
Instruction Fuzzy Hash: 50910575D0021DAFDF14DFA4C880EEEB7B8BF08304F108569E919A7291DB709A48CFA1

Function 00C82B99 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C82C1F
GetMenuItemCount.USER32(00000000), ref: 00C82C51
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C82C79
_wcslen.LIBCMT ref: 00C82CAF
GetMenuItemID.USER32(?,?), ref: 00C82CE9
GetSubMenu.USER32(?,?), ref: 00C82CF7

Part of subcall function 00C54393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C543AD
Part of subcall function 00C54393: GetCurrentThreadId.KERNEL32 ref: 00C543B4
Part of subcall function 00C54393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C52F00), ref: 00C543BB

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C82D7F

Part of subcall function 00C5F292: Sleep.KERNEL32 ref: 00C5F30A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 81a13c0b8d0a63974e90b5d3261e2cb7f9a5d48a4bec7918412d052125db494e
Instruction ID: c3ecc193da96e6ffe5078197e8f576c422818a922a5a4b4f220d1927431db2fd
Opcode Fuzzy Hash: 81a13c0b8d0a63974e90b5d3261e2cb7f9a5d48a4bec7918412d052125db494e
Instruction Fuzzy Hash: 81719075A00209AFCB14EF64C849ABEBBF1EF48314F108459E826EB351DB34EE41DB94

Function 00C888F9 Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C88992
IsWindowEnabled.USER32(00000000), ref: 00C8899E
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00C88A79
SendMessageW.USER32(00000000,000000B0,?,?), ref: 00C88AAC
IsDlgButtonChecked.USER32(?,00000000), ref: 00C88AE4
GetWindowLongW.USER32(00000000,000000EC), ref: 00C88B06
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C88B1E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c90d982bb41854327ae2caee65924f45ecfe6df2f682345ce4799e10cd313245
Instruction ID: 039f304366fdd0c95755e2cff5791f72acbd2ff698a1d2fb881e4e13a9bd9a45
Opcode Fuzzy Hash: c90d982bb41854327ae2caee65924f45ecfe6df2f682345ce4799e10cd313245
Instruction Fuzzy Hash: E671B074600204AFDF25EF94C884FFA7BB5FF49308F540459E865A76A1CB31AE48EB58

Function 00C5B881 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C5B8C0
GetKeyboardState.USER32(?), ref: 00C5B8D5
SetKeyboardState.USER32(?), ref: 00C5B936
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C5B964
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C5B983
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C5B9C4
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C5B9E7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 28f31f5b4febf2488d27658340aeb77cd60623935d7b3318aa55bb1bb27f1ee9
Instruction ID: f494c1f1e45cd907a829ce332bb7a67658384bffead0087f4fb63aee14986174
Opcode Fuzzy Hash: 28f31f5b4febf2488d27658340aeb77cd60623935d7b3318aa55bb1bb27f1ee9
Instruction Fuzzy Hash: 245103A45087D53EFB3246348C56BBABFA95F06305F088489F9E5458D2C3D8AECCE758

Function 00C5B6A1 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C5B6E0
GetKeyboardState.USER32(?), ref: 00C5B6F5
SetKeyboardState.USER32(?), ref: 00C5B756
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C5B782
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C5B79F
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C5B7DE
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C5B7FF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 13484cb1d34d7ffd3515d8075dd3c2c31e10c9e9a4e78ee53025e3b068ce842b
Instruction ID: 21acf53ef7bdfd953fd2e411591d7069c9e46ec023acfa9817959ccb98628243
Opcode Fuzzy Hash: 13484cb1d34d7ffd3515d8075dd3c2c31e10c9e9a4e78ee53025e3b068ce842b
Instruction Fuzzy Hash: 995105A49047D53EFB3283248C15B7ABE985B45345F088489F4E5468C2D394EECCE768

Function 00C257A1 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00C25F16,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 00C257E3
__fassign.LIBCMT ref: 00C2585E
__fassign.LIBCMT ref: 00C25879
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 00C2589F
WriteFile.KERNEL32(?,FF8BC35D,00000000,00C25F16,00000000,?,?,?,?,?,?,?,?,?,00C25F16,?), ref: 00C258BE
WriteFile.KERNEL32(?,?,00000001,00C25F16,00000000,?,?,?,?,?,?,?,?,?,00C25F16,?), ref: 00C258F7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 59dd49c58f436742fc09c6cad8ff234600cb4bb7f33757331f2df9a7b26e5a68
Instruction ID: 76140b9dc951b19a2c1d5b78b12db7f8a663ba6bd024d80fca06922c33971784
Opcode Fuzzy Hash: 59dd49c58f436742fc09c6cad8ff234600cb4bb7f33757331f2df9a7b26e5a68
Instruction Fuzzy Hash: 4B51C371900659DFCB10DFA8E885BEEBBF8EF09310F14411AE952E7291D7709A42CF60

Function 00C13090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C130BB
___except_validate_context_record.LIBVCRUNTIME ref: 00C130C3
_ValidateLocalCookies.LIBCMT ref: 00C13151
__IsNonwritableInCurrentImage.LIBCMT ref: 00C1317C
_ValidateLocalCookies.LIBCMT ref: 00C131D1

Strings

csm, xrefs: 00C13166

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a4e6116b7a40e8c3692a667e6095dde0de10a3f3b365dcc8b1b03a12f3c1665c
Instruction ID: ff18bf5f8f0deb884d36e21d9ee0f01c8be25a0c95d3d1b9614ca12feffc4bed
Opcode Fuzzy Hash: a4e6116b7a40e8c3692a667e6095dde0de10a3f3b365dcc8b1b03a12f3c1665c
Instruction Fuzzy Hash: 9641DB34E00249EBCF10DF58C845BDE7BB5AF46328F248155E815AB392D731DB85EB91

Function 00C71B15 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C73AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C73AD7
Part of subcall function 00C73AAB: _wcslen.LIBCMT ref: 00C73AF8

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00C71B6F
WSAGetLastError.WSOCK32 ref: 00C71B7E
WSAGetLastError.WSOCK32 ref: 00C71C26
closesocket.WSOCK32(00000000), ref: 00C71C56

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: f86b06bb45113890d5c7aed5063c46affc066fbf2541116748eb440582d09e63
Instruction ID: 2b703c61bb494d2a4748a0ac9938095e9c6fa2a5f65afbb4bcb75f15c9124c31
Opcode Fuzzy Hash: f86b06bb45113890d5c7aed5063c46affc066fbf2541116748eb440582d09e63
Instruction Fuzzy Hash: 3141C271600108AFDB109F68C885BB9BBE9EF45324F18C059ED1A9B2D2D770EE45CBE1

Function 00C5D7AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C5D7CD,?), ref: 00C5E714

Part of subcall function 00C5E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C5D7CD,?), ref: 00C5E72D

lstrcmpiW.KERNEL32(?,?), ref: 00C5D7F0
MoveFileW.KERNEL32(?,?), ref: 00C5D82A
_wcslen.LIBCMT ref: 00C5D8B0
_wcslen.LIBCMT ref: 00C5D8C6
SHFileOperationW.SHELL32(?), ref: 00C5D90C

Strings

\*.*, xrefs: 00C5D89E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 3bc8467849b249247427951d82ca7f6077d3a0468aedd0109e2eb430249b360e
Instruction ID: f607c880652d7ca720cde2a743ce7d70620e2e4e1a05ca0daf5fa44a796dd8f1
Opcode Fuzzy Hash: 3bc8467849b249247427951d82ca7f6077d3a0468aedd0109e2eb430249b360e
Instruction Fuzzy Hash: 2D4157759053189EDF16EFA4C981BDD77B8AF04341F1000EAA916EB182EB35A7CCDB54

Function 00C83899 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00C838B8
GetWindowLongW.USER32(?,000000F0), ref: 00C838EB
GetWindowLongW.USER32(?,000000F0), ref: 00C83920
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00C83952
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00C8397C
GetWindowLongW.USER32(?,000000F0), ref: 00C8398D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C839A7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e26404e99c318dd0c683ae17262120bbbacab1579183cd726b671cc65354fe1a
Instruction ID: a5262c0995c3dc2089d191d25e063132070980f918b7799095b63475dbcf7cef
Opcode Fuzzy Hash: e26404e99c318dd0c683ae17262120bbbacab1579183cd726b671cc65354fe1a
Instruction Fuzzy Hash: 09314830704295AFDB21EF48DC84F6937A5FB86B14F152164F5218B2F1CBB1AE44DB09

Function 00C5808D Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C580D0
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C580F6
SysAllocString.OLEAUT32(00000000), ref: 00C580F9
SysAllocString.OLEAUT32(?), ref: 00C58117
SysFreeString.OLEAUT32(?), ref: 00C58120
StringFromGUID2.OLE32(?,?,00000028), ref: 00C58145
SysAllocString.OLEAUT32(?), ref: 00C58153

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 60c9be4a4de559de177ac1f2bde1c03c9a867a95b7ab47737cd143210ab1a80d
Instruction ID: 3663556a680bcea4052af4d5ab4f1c04a3dd134cf325e05654e9fcbdd6462801
Opcode Fuzzy Hash: 60c9be4a4de559de177ac1f2bde1c03c9a867a95b7ab47737cd143210ab1a80d
Instruction Fuzzy Hash: A521A636600219AF9F10DFA8DC88DBF73ACEB493617008425FD15DB2D1DA70DD8A8B68

Function 00C58164 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C581A9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C581CF
SysAllocString.OLEAUT32(00000000), ref: 00C581D2
SysAllocString.OLEAUT32 ref: 00C581F3
SysFreeString.OLEAUT32 ref: 00C581FC
StringFromGUID2.OLE32(?,?,00000028), ref: 00C58216
SysAllocString.OLEAUT32(?), ref: 00C58224

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d0a69b7062ae6cd19302cd9eb05c7257cb61a40794b1bbdba2b9ccf93fe04256
Instruction ID: 940803e25157a1a83ab8601fde258cd3adfd08abc8ec2c0dd05ac40141c91196
Opcode Fuzzy Hash: d0a69b7062ae6cd19302cd9eb05c7257cb61a40794b1bbdba2b9ccf93fe04256
Instruction Fuzzy Hash: 9C21B835600504BFDB10DFA8DC88EAE77ECEB09361B108125FD16DB1A0DA70DD89CB68

Function 00C60E79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C60E99
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C60ED5

Strings

nul, xrefs: 00C60F0E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 58f5dae13faa16203a0c54463a0b529e9e77216227787f62e6211f59496e31e0
Instruction ID: ee21487c07575db302eb3bd94fa143de3055d616c1356ffbf541e454544b646c
Opcode Fuzzy Hash: 58f5dae13faa16203a0c54463a0b529e9e77216227787f62e6211f59496e31e0
Instruction Fuzzy Hash: 78217A7050030AABDB308F69D884B9B7BA8AF54320F300A59FCA5E72D1D770AA40DB55

Function 00C60F4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C60F6D
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C60FA8

Strings

nul, xrefs: 00C60FE0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 82281d3769d646383049f41a80e9894f39b2a4adfc4834871f95f9182ff9bc8a
Instruction ID: cef154838b7fa6c44b9db50f70d3cf928e9030dec7457d90bd7af6c5873cdf72
Opcode Fuzzy Hash: 82281d3769d646383049f41a80e9894f39b2a4adfc4834871f95f9182ff9bc8a
Instruction Fuzzy Hash: 87216B715003459BDB308FA99C85B9A77A8BF55731F380A19FCB2E32E1D7B09A80DB51

Function 00C84B4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF7873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BF78B1
Part of subcall function 00BF7873: GetStockObject.GDI32(00000011), ref: 00BF78C5
Part of subcall function 00BF7873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BF78CF

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C84BB0
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C84BBD
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C84BC8
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C84BD7
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C84BE3

Strings

Msctls_Progress32, xrefs: 00C84B81

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: b9671e6c243052568f0ab1a718d608385f042936f76366322b9a56892ddfa552
Instruction ID: f69ad7a29a32d32f144ae4fc8f0e1f2bb284ea94fa15fc504ad6e1350bd68dc1
Opcode Fuzzy Hash: b9671e6c243052568f0ab1a718d608385f042936f76366322b9a56892ddfa552
Instruction Fuzzy Hash: 6E1151B255021ABEEB119F65CC85FEB7F9DEF08798F014111BA18A6090CA71DC219BA4

Function 00C2DB5F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C2DB23: _free.LIBCMT ref: 00C2DB4C

_free.LIBCMT ref: 00C2DBAD

Part of subcall function 00C22D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4), ref: 00C22D4E
Part of subcall function 00C22D38: GetLastError.KERNEL32(00CC1DC4,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4,00CC1DC4), ref: 00C22D60

_free.LIBCMT ref: 00C2DBB8
_free.LIBCMT ref: 00C2DBC3
_free.LIBCMT ref: 00C2DC17
_free.LIBCMT ref: 00C2DC22
_free.LIBCMT ref: 00C2DC2D
_free.LIBCMT ref: 00C2DC38

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction ID: 239186102a99ed4ced6a838bb9c3fe18a48006c4bea9e388f61cb780ad389260
Opcode Fuzzy Hash: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction Fuzzy Hash: 88113372581B24BBD520BBB0EC0BFCB77DC9F24701F814C19B2DBAA952DA75B504AB50

Function 00C5E30E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C5E328
LoadStringW.USER32(00000000), ref: 00C5E32F
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C5E345
LoadStringW.USER32(00000000), ref: 00C5E34C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C5E390

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C5E36D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: c30cc01669535e96d492f071106b332c8ac9ece7d15685f84757121812a52cde
Instruction ID: d04968c66935c82bf23c58454b72ddc23fce4a3da29fc1d968b3c57b9d710d67
Opcode Fuzzy Hash: c30cc01669535e96d492f071106b332c8ac9ece7d15685f84757121812a52cde
Instruction Fuzzy Hash: 950112F69002087FE711ABA49D89FEA776CDB08301F4045A1BB46E6091E6749E888B79

Function 00C61312 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00C61322
EnterCriticalSection.KERNEL32(00000000,?), ref: 00C61334
TerminateThread.KERNEL32(00000000,000001F6), ref: 00C61342
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00C61350
CloseHandle.KERNEL32(00000000), ref: 00C6135F
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C6136F
LeaveCriticalSection.KERNEL32(00000000), ref: 00C61376

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 14251fd423c163c6e7c6a9153eadd373ac306696b8787c01e69eb94814a210cb
Instruction ID: cfc6c74ff99fd247139d98a1813b7f64b21bb8df92bfbd1c1576609cb366ea6d
Opcode Fuzzy Hash: 14251fd423c163c6e7c6a9153eadd373ac306696b8787c01e69eb94814a210cb
Instruction Fuzzy Hash: 2FF0C932042612ABD7512B54EE89BDABB39BF04312F441121F103918F097749961DF98

Function 00C726BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00C7281D
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C7283E
WSAGetLastError.WSOCK32 ref: 00C7284F
htons.WSOCK32(?,?,?,?,?), ref: 00C72938
inet_ntoa.WSOCK32(?), ref: 00C728E9

Part of subcall function 00C5433E: _strlen.LIBCMT ref: 00C54348

Part of subcall function 00C73C81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00C6F669), ref: 00C73C9D

_strlen.LIBCMT ref: 00C72992

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 269244bb363cfb49df7c590a3ca0a58e687a5928fcebb45f01d2aa6e3096f7cb
Instruction ID: e6622472750a4f20e1d80f4b95af856fc10b33b535d89f7639637b04ec077b4e
Opcode Fuzzy Hash: 269244bb363cfb49df7c590a3ca0a58e687a5928fcebb45f01d2aa6e3096f7cb
Instruction Fuzzy Hash: ECB1B435504301AFD324DF24C885F2ABBE5AF84318F54859CF56A4B2E2DB71EE85CB91

Function 00C20527 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00C2042A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C20446
__allrem.LIBCMT ref: 00C2045D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C2047B
__allrem.LIBCMT ref: 00C20492
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C204B0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction ID: bdbfa788b1600daf940c527e2f22301b3cd13ccace3618520468ab08620b7a34
Opcode Fuzzy Hash: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction Fuzzy Hash: 9F81FB72600B259BD720EE69EC81B6EB3A9AF44320F34812BF521D7A93E770DE409754

Function 00C26571 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00C18649,00C18649,?,?,?,00C267C2,00000001,00000001,8BE85006), ref: 00C265CB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00C267C2,00000001,00000001,8BE85006,?,?,?), ref: 00C26651
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00C2674B
__freea.LIBCMT ref: 00C26758

Part of subcall function 00C23B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00C16A79,?,0000015D,?,?,?,?,00C185B0,000000FF,00000000,?,?), ref: 00C23BC5

__freea.LIBCMT ref: 00C26761
__freea.LIBCMT ref: 00C26786

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 2850d91c33c7272e789a8d97a4e1eefda2a9b8fc2760d1729496b62a38a30996
Instruction ID: f6330a4318be0416631b68815478ab04ff14a15c136bce36748b5da618781b26
Opcode Fuzzy Hash: 2850d91c33c7272e789a8d97a4e1eefda2a9b8fc2760d1729496b62a38a30996
Instruction Fuzzy Hash: A451FF72610226AFEB258E64EC85EAF77AAEF40B14F140268FC25D6580EB34DD5096B0

Function 00C7C63B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C7D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7C10E,?,?), ref: 00C7D415
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D451
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4C8
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C7C72A
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C7C785
RegCloseKey.ADVAPI32(00000000), ref: 00C7C7CA
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C7C7F9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C7C853
RegCloseKey.ADVAPI32(?), ref: 00C7C85F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 92d69ee40cf3173d8184192074f3812029b4883949c711031e374776f15aaed9
Instruction ID: 22aee9a0ae68facb52988a112dac6e68f1ee68794c1048ef4307612ac30c665b
Opcode Fuzzy Hash: 92d69ee40cf3173d8184192074f3812029b4883949c711031e374776f15aaed9
Instruction Fuzzy Hash: 33819075108246AFC714DF24C8C5E2ABBE5FF84308F14859CF55A4B2A2DB31EE49CB92

Function 00C5009D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00C500A9
SysAllocString.OLEAUT32(00000000), ref: 00C50150
VariantCopy.OLEAUT32(00C50354,00000000), ref: 00C50179
VariantClear.OLEAUT32(00C50354), ref: 00C5019D
VariantCopy.OLEAUT32(00C50354,00000000), ref: 00C501A1
VariantClear.OLEAUT32(?), ref: 00C501AB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 14146f39491e55f129fe0ae3d022a77b46267a45cac39665b438f11fd61ec682
Instruction ID: 7c420241521da85a95dc71ad48955675fc91a074151029a5ab2f69070e4c41e8
Opcode Fuzzy Hash: 14146f39491e55f129fe0ae3d022a77b46267a45cac39665b438f11fd61ec682
Instruction Fuzzy Hash: FA51C539600314AACF20AB659C89B2DB3A5EF45312F349446ED06DF2D6DB709CC8DB5A

Function 00C69B51 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00BF41EA: _wcslen.LIBCMT ref: 00BF41EF

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

GetOpenFileNameW.COMDLG32(00000058), ref: 00C69F2A
_wcslen.LIBCMT ref: 00C69F4B
_wcslen.LIBCMT ref: 00C69F72
GetSaveFileNameW.COMDLG32(00000058), ref: 00C69FCA

Strings

X, xrefs: 00C69E57

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: ce5d26c8f9730ec42ef1e6b492cc1d85d15fc848a9aaf0107d2b9b16d4e4dd05
Instruction ID: a0031a63d50c1e3e621d3155d76ac02d05c30590d628b2064c7658a4705b821a
Opcode Fuzzy Hash: ce5d26c8f9730ec42ef1e6b492cc1d85d15fc848a9aaf0107d2b9b16d4e4dd05
Instruction Fuzzy Hash: 15E1A2315043049FC724EF24C881B6AB7E4FF85314F1489ADF99A9B2A2DB71DD49CB92

Function 00C66ED3 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C66F21
CoInitialize.OLE32(00000000), ref: 00C6707E
CoCreateInstance.OLE32(00C90CC4,00000000,00000001,00C90B34,?), ref: 00C67095
CoUninitialize.OLE32 ref: 00C67319

Strings

.lnk, xrefs: 00C66EFF, 00C66F69, 00C67025

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 0719a0d1733643b9683cec78249d4597a7ad0a9c66034253c667a64c9a5218f1
Instruction ID: 8b2736291311926275d7e05f9a83f078da9303068860260a3021673dbec32f68
Opcode Fuzzy Hash: 0719a0d1733643b9683cec78249d4597a7ad0a9c66034253c667a64c9a5218f1
Instruction Fuzzy Hash: 82D14A71508205AFC314EF64C881E6BB7E8FF98708F40496DF5968B262DB71ED49CB92

Function 00BF1B00 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

BeginPaint.USER32(?,?,?), ref: 00BF1B35
GetWindowRect.USER32(?,?), ref: 00BF1B99
ScreenToClient.USER32(?,?), ref: 00BF1BB6
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BF1BC7
EndPaint.USER32(?,?,?,?,?), ref: 00BF1C15
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00C33287

Part of subcall function 00BF1C2D: BeginPath.GDI32(00000000), ref: 00BF1C4B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: f4bfa8c2c30340471440f244be045e8a1990c67a80ea7e722309298234b18359
Instruction ID: cb14caeb045299dadb73295833dc3ef3e86c5213591788da8da5f8cf9c967a1b
Opcode Fuzzy Hash: f4bfa8c2c30340471440f244be045e8a1990c67a80ea7e722309298234b18359
Instruction Fuzzy Hash: AA418070204344EFD710EF28DC85FBA7BE8EB45334F140AA9FA658B1A2D7719948DB61

Function 00C61196 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C611B3
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00C611EE
EnterCriticalSection.KERNEL32(?), ref: 00C6120A
LeaveCriticalSection.KERNEL32(?), ref: 00C61283
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00C6129A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C612C8

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 501c87cbcdf2caa3681e84999bce86b5fef20eff0472100ff9384518ddf688a6
Instruction ID: deaacf5fee04703127071e27fd576a7fe35ab2be6d079afe97bf4325eff141cf
Opcode Fuzzy Hash: 501c87cbcdf2caa3681e84999bce86b5fef20eff0472100ff9384518ddf688a6
Instruction Fuzzy Hash: 88414A71900205ABDF149F54DCC5BAEB7B8FF05311F2840A5EE009A296DB74DEA1EBA4

Function 00C88C36 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00C4FBEF,00000000,?,?,00000000,?,00C339E2,00000004,00000000,00000000), ref: 00C88CA7
EnableWindow.USER32(?,00000000), ref: 00C88CCD
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00C88D2C
ShowWindow.USER32(?,00000004), ref: 00C88D40
EnableWindow.USER32(?,00000001), ref: 00C88D66
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00C88D8A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: dece3494d01932e30da615a42e3f537b873804966ea454eda8b8ffeb07d62003
Instruction ID: 4f9f1871905894e99f8240f7a7116f8b1e139f724c6fd78685a71630b7333c78
Opcode Fuzzy Hash: dece3494d01932e30da615a42e3f537b873804966ea454eda8b8ffeb07d62003
Instruction Fuzzy Hash: 32412930601245AFDB25EF24C889FA57BF0FF45309F5800A9E5194B6B6CB71AD4ACB64

Function 00C72D37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00C72D45

Part of subcall function 00C6EF33: GetWindowRect.USER32(?,?), ref: 00C6EF4B

GetDesktopWindow.USER32 ref: 00C72D6F
GetWindowRect.USER32(00000000), ref: 00C72D76
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00C72DB2
GetCursorPos.USER32(?), ref: 00C72DDE
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C72E3C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: e09af1b056228ecb053c4abc990b10c3e01b241166cad3b8584d09bc31336db4
Instruction ID: 24ea46e3b88150bd5e31aa2421ec65651029732866d4921c54cc6fbde8168f01
Opcode Fuzzy Hash: e09af1b056228ecb053c4abc990b10c3e01b241166cad3b8584d09bc31336db4
Instruction Fuzzy Hash: 4231DC72505315AFC720DF54C849F9BB7A9FF94314F00492EF899A7181DA30EA89CBD6

Function 00C555E1 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C555F9
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C55616
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C5564E
_wcslen.LIBCMT ref: 00C5566C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C55674
_wcsstr.LIBVCRUNTIME ref: 00C5567E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: c788117b6048bc726a1dde8d49396cc97343e54fbcb9c480d4c7a31be2edfd94
Instruction ID: d341be239acb9e13948f053f5ebfc6cf76a4ef1edf430b6f14c49ab5d6cae6ce
Opcode Fuzzy Hash: c788117b6048bc726a1dde8d49396cc97343e54fbcb9c480d4c7a31be2edfd94
Instruction Fuzzy Hash: 78214676204640BBEB155B25DC19FBF7BA8EF45721F104029FC06CA291EFA0CDC0A7A4

Function 00C66263 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BF55D1,?,?,00C34B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00BF5871

_wcslen.LIBCMT ref: 00C662C0
CoInitialize.OLE32(00000000), ref: 00C663DA
CoCreateInstance.OLE32(00C90CC4,00000000,00000001,00C90B34,?), ref: 00C663F3
CoUninitialize.OLE32 ref: 00C66411

Strings

.lnk, xrefs: 00C662BB, 00C66306, 00C663CA

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 1394c87b144b9923ab576954dc4498bffe790e55368e8e2078fe09a7a606a84f
Instruction ID: df069347bb6911ec9e1111d66a245d83d388a688c97cb309cec69606ce3a6aa0
Opcode Fuzzy Hash: 1394c87b144b9923ab576954dc4498bffe790e55368e8e2078fe09a7a606a84f
Instruction Fuzzy Hash: 66D15571A043059FC724DF24C484A2ABBE5FF89714F1489ACF9969B361CB31ED49CB92

Function 00C886FC Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00C88740
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00C88765
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C8877D
GetSystemMetrics.USER32(00000004), ref: 00C887A6
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00C6C1F2,00000000), ref: 00C887C6

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

GetSystemMetrics.USER32(00000004), ref: 00C887B1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 22e0751a7928825e2de6e9da64e9f221f44daad58b3d3e933d85f5db49b01684
Instruction ID: 7219164248e17822f85842bd0c43ac1018c418dbe4cdd1dbda2e9b55ee685637
Opcode Fuzzy Hash: 22e0751a7928825e2de6e9da64e9f221f44daad58b3d3e933d85f5db49b01684
Instruction Fuzzy Hash: E4219071610245AFCB14AF39CC48B6E37B6EB44329F654A29F937C29E0EF308954CB18

Function 00C136F2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00C136E9,00C13355), ref: 00C13700
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00C1370E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00C13727
SetLastError.KERNEL32(00000000,?,00C136E9,00C13355), ref: 00C13779

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ce703b4a5f469cdc639511cfbcf176388042cca59412d4be314ba3a2371cb706
Instruction ID: 22f1d087bbc06c0fe718b81916d937234484dfbfb134c0e3afe1ffb8b05c15a6
Opcode Fuzzy Hash: ce703b4a5f469cdc639511cfbcf176388042cca59412d4be314ba3a2371cb706
Instruction Fuzzy Hash: 5601D8B66193516EA6243BB5BDCA7EA3B94EB17779B200339F122450F0FF514E827284

Function 00C230E7 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00C14D53,00000000,?,?,00C168E2,?,?,00000000), ref: 00C230EB
_free.LIBCMT ref: 00C2311E
_free.LIBCMT ref: 00C23146
SetLastError.KERNEL32(00000000,?,00000000), ref: 00C23153
SetLastError.KERNEL32(00000000,?,00000000), ref: 00C2315F
_abort.LIBCMT ref: 00C23165

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: bccc1c30b8036bc96ae86d1d852d7289104e65c4b206eabec2cd53c0bdfd91ab
Instruction ID: 90fee962fa2008276e37332169853a4258d2ffbb1ccb8254fd58c02a2e742c84
Opcode Fuzzy Hash: bccc1c30b8036bc96ae86d1d852d7289104e65c4b206eabec2cd53c0bdfd91ab
Instruction Fuzzy Hash: EAF0A43694457036C2123779BC06B5E177A9FC1771F250534F92592AE1EE288A12A661

Function 00C89480 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BF1F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BF1F87
Part of subcall function 00BF1F2D: SelectObject.GDI32(?,00000000), ref: 00BF1F96
Part of subcall function 00BF1F2D: BeginPath.GDI32(?), ref: 00BF1FAD
Part of subcall function 00BF1F2D: SelectObject.GDI32(?,00000000), ref: 00BF1FD6

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00C894AA
LineTo.GDI32(?,00000003,00000000), ref: 00C894BE
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00C894CC
LineTo.GDI32(?,00000000,00000003), ref: 00C894DC
EndPath.GDI32(?), ref: 00C894EC
StrokePath.GDI32(?), ref: 00C894FC

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 81995429e6abbaeba5ef317fc19b316033b14b0945855ccefddb6768051881b3
Instruction ID: e144d15318672609e9670be5891e2f340fd41d5ac3ee283006254a5983bad06e
Opcode Fuzzy Hash: 81995429e6abbaeba5ef317fc19b316033b14b0945855ccefddb6768051881b3
Instruction Fuzzy Hash: 5011097200010DBFDB02AF90DC88FAE7F6DEB08364F048011FA1A4A1A1C7719E559BA4

Function 00C55B61 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C55B7C
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C55B8D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C55B94
ReleaseDC.USER32(00000000,00000000), ref: 00C55B9C
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C55BB3
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00C55BC5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 299f08ab16fe72b204f2dd1b2ff1011f134e85a9c0901bd4fe370f46ae787142
Instruction ID: 3018a3b5dffa67dbf7f7c925a5d3b2780fe20c0ac578bc7f3d7925c720efc048
Opcode Fuzzy Hash: 299f08ab16fe72b204f2dd1b2ff1011f134e85a9c0901bd4fe370f46ae787142
Instruction Fuzzy Hash: 56014F75A00719BBEB109FA59C49F4EBFB8EF48762F104065FA09E7280D6709D04CBA4

Function 00BF327E Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BF32AF
MapVirtualKeyW.USER32(00000010,00000000), ref: 00BF32B7
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BF32C2
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BF32CD
MapVirtualKeyW.USER32(00000011,00000000), ref: 00BF32D5
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BF32DD

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d91c7c905903a630b23b518f7207198dc9e06b6102f42c3f2f3e886ce2d18c4e
Instruction ID: fddea36d66160ab13fc30d04e52f0a925dae2abd84556181e34dcb6ebab4707a
Opcode Fuzzy Hash: d91c7c905903a630b23b518f7207198dc9e06b6102f42c3f2f3e886ce2d18c4e
Instruction Fuzzy Hash: 91016CB09017597DE3008F5A8C85B56FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 00C5F437 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C5F447
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C5F45D
GetWindowThreadProcessId.USER32(?,?), ref: 00C5F46C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C5F47B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C5F485
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C5F48C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: dd83cba57bae019d991d23bda639f453c4eb1cbb8cbc3582258c30be40a7e381
Instruction ID: 04071b8ad5b9a5666e8d28c46c644f7fe6ad7d0ea961b19f1b2b1f50e61a58d1
Opcode Fuzzy Hash: dd83cba57bae019d991d23bda639f453c4eb1cbb8cbc3582258c30be40a7e381
Instruction Fuzzy Hash: 8EF03032241158BBE7215752AC0EFEF3B7CEFC6B21F000058F612910D0E7A06A41D7B9

Function 00C334D6 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00C334EF
SendMessageW.USER32(?,00001328,00000000,?), ref: 00C33506
GetWindowDC.USER32(?), ref: 00C33512
GetPixel.GDI32(00000000,?,?), ref: 00C33521
ReleaseDC.USER32(?,00000000), ref: 00C33533
GetSysColor.USER32(00000005), ref: 00C3354D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: c3993455e908ae94cbbe21c84bd3fc50e8526d78850eb9dc53e02a843197edf8
Instruction ID: 5d445cf74379091ce43a97098f2e20b8e740cd7e654ca92a4af0a6c52cfb8ca8
Opcode Fuzzy Hash: c3993455e908ae94cbbe21c84bd3fc50e8526d78850eb9dc53e02a843197edf8
Instruction Fuzzy Hash: D2012431500209EFEB506FA4DC08FEE7BB6FF08321F510561FA2AA21E0CB321E51AB14

Function 00C521C1 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C521CC
UnloadUserProfile.USERENV(?,?), ref: 00C521D8
CloseHandle.KERNEL32(?), ref: 00C521E1
CloseHandle.KERNEL32(?), ref: 00C521E9
GetProcessHeap.KERNEL32(00000000,?), ref: 00C521F2
HeapFree.KERNEL32(00000000), ref: 00C521F9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 8dbfbb89ee219169adfed8c0495de2919499ea496147b98c33203aad05b32910
Instruction ID: b5a1d2bf75aaf6a343f5e6cb986ec564f214fc307b216533ac470a9daf927839
Opcode Fuzzy Hash: 8dbfbb89ee219169adfed8c0495de2919499ea496147b98c33203aad05b32910
Instruction Fuzzy Hash: D2E07576104505BBDB012FA5EC0DF4EBF79FF49732B504625F226824B4CB329861EB59

Function 00C5CE7B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF41EA: _wcslen.LIBCMT ref: 00BF41EF

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C5CF99
_wcslen.LIBCMT ref: 00C5CFE0
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C5D047
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C5D075

Strings

0, xrefs: 00C5CF5A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 8619140f8558c019a954923b727f20a2748f7c41860e5fe465af9c7772cb0bcb
Instruction ID: 99c8ae077c5b8be87b31aec2ba1b0e8abac4d3e4aff8c6383d867439868ad111
Opcode Fuzzy Hash: 8619140f8558c019a954923b727f20a2748f7c41860e5fe465af9c7772cb0bcb
Instruction Fuzzy Hash: 2E51C1756043009FD724AE64C885B6FB7E8EB85316F040A2DFDA6D31D0DBB0CAC9975A

Function 00C7B7C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00C7B903

Part of subcall function 00BF41EA: _wcslen.LIBCMT ref: 00BF41EF

GetProcessId.KERNEL32(00000000), ref: 00C7B998
CloseHandle.KERNEL32(00000000), ref: 00C7B9C7

Strings

@, xrefs: 00C7B8D2
<, xrefs: 00C7B8CB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 89b9cddd47038f2b947093dc02b90a69558b5cb8c0594dfb1c05802acdd8209b
Instruction ID: b5ed2b76269d0b3e8c6361d3cb4af68c9be5ba494f072ba4eb42dd3296c9f0fe
Opcode Fuzzy Hash: 89b9cddd47038f2b947093dc02b90a69558b5cb8c0594dfb1c05802acdd8209b
Instruction Fuzzy Hash: F0714A75A00219DFCB14DF54C494AAEBBF5FF08310F048499E96AAB391CB74EE45CB91

Function 00C57B05 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00C57B6D
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00C57BA3
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00C57BB4
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00C57C36

Strings

DllGetClassObject, xrefs: 00C57BA9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4301b9d0f3cfb0984fa9c3d9e396fc924cbd5910a96be6fdb34f61c499b0fbed
Instruction ID: dccc784ee8310713c5a2ea59cce497d6a0a2d55ad69c5575e9cab0fea00c64be
Opcode Fuzzy Hash: 4301b9d0f3cfb0984fa9c3d9e396fc924cbd5910a96be6fdb34f61c499b0fbed
Instruction Fuzzy Hash: 6141C575604204DFDB15CF25E888B9A7BB9EF44312F1081A9AC069F245D7B0EDC8CBA4

Function 00C84818 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C848D1
IsMenu.USER32(?), ref: 00C848E6
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C8492E
DrawMenuBar.USER32 ref: 00C84941

Strings

0, xrefs: 00C84825

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: beaa638b99c0b6905c377809c9da03aebffbae6ed841b588f17101c73499b089
Instruction ID: 9c73f46078c03cb01db07e7e17bf122455bc2a112f7ca235c6ebf13c01f558ce
Opcode Fuzzy Hash: beaa638b99c0b6905c377809c9da03aebffbae6ed841b588f17101c73499b089
Instruction Fuzzy Hash: 43415B75A0020AEFDB24EF51D884EABBBB9FF16328F044129F95597290D730EE54CB64

Function 00C5272F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C527B3
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C527C6
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C527F6

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

Strings

ListBox, xrefs: 00C52772
ComboBox, xrefs: 00C5273D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: f00d3409c8cb6e02ef388b9f3cfeef49d470a3ae693ffde47953466abab7d9ea
Instruction ID: 35029aec81e1d8a60d174c22a12c3fa7c0dc95721061536e190d8950faef7719
Opcode Fuzzy Hash: f00d3409c8cb6e02ef388b9f3cfeef49d470a3ae693ffde47953466abab7d9ea
Instruction Fuzzy Hash: 8C21F37A940108BFDB09ABA0D846DFF77F8DF46361F104129F922A71E1DB38498E9764

Function 00C839B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C83A29
LoadLibraryW.KERNEL32(?), ref: 00C83A30
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C83A45
DestroyWindow.USER32(?), ref: 00C83A4D

Strings

SysAnimate32, xrefs: 00C83A04

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: f2ccb524f45bfb0c48716bc296a1af9b9dabaf7e2f3de63efcadff12c8e7e989
Instruction ID: aaf30d95e53d280b11fa669db0902e200867f3803ce80b8f3b247f54020b5b9c
Opcode Fuzzy Hash: f2ccb524f45bfb0c48716bc296a1af9b9dabaf7e2f3de63efcadff12c8e7e989
Instruction Fuzzy Hash: E921D471100245ABEF10AFE4DC80FBB37ADEB44B68F106614FAA1920D0C771CE41A768

Function 00C150DD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00C1508E,?,?,00C1502E,?,00CB98D8,0000000C,00C15185,?,00000002), ref: 00C150FD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C15110
FreeLibrary.KERNEL32(00000000,?,?,?,00C1508E,?,?,00C1502E,?,00CB98D8,0000000C,00C15185,?,00000002,00000000), ref: 00C15133

Strings

CorExitProcess, xrefs: 00C15108
mscoree.dll, xrefs: 00C150F6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3322016a4f9faf80e3162c7d3652e1aed7a0b7399406881a7d30906e27690e25
Instruction ID: a252acaacc186587146fa62de6225253fb6da34dcec5f4ce7e5619c00635cadb
Opcode Fuzzy Hash: 3322016a4f9faf80e3162c7d3652e1aed7a0b7399406881a7d30906e27690e25
Instruction Fuzzy Hash: BFF06231A40209FBDB119F94DC49BEDBFB5EF45762F5400A4F806A21A0DB749E80DB94

Function 00BF663E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BF668B,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF664A
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BF665C
FreeLibrary.KERNEL32(00000000,?,?,00BF668B,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF666E

Strings

Wow64DisableWow64FsRedirection, xrefs: 00BF6656
kernel32.dll, xrefs: 00BF6642

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 0d8bbec4381175c14ce0b96a27f65e21040a8c52959c4825e61f756a4278b5ba
Instruction ID: 287d11fa05df9bcc1ef9d64473a0db43eea74897d1aca733c11e2157165cb3e8
Opcode Fuzzy Hash: 0d8bbec4381175c14ce0b96a27f65e21040a8c52959c4825e61f756a4278b5ba
Instruction Fuzzy Hash: 5DE086366015223792212725BC0CBAE6768DF92F36B050165FD01D3184DF50CC0583A8

Function 00BF6607 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00C35657,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF6610
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BF6622
FreeLibrary.KERNEL32(00000000,?,?,00C35657,?,?,00BF62FA,?,00000001,?,?,00000000), ref: 00BF6635

Strings

Wow64RevertWow64FsRedirection, xrefs: 00BF661C
kernel32.dll, xrefs: 00BF6609

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: dcc403a6f571b3fec4fd099008fd8c7b962a70b5c0a849efe306c9c81edc8744
Instruction ID: 3c44982f280a8cee4838f89ef1c75a5040524d7df963cfc314aacc8268771d31
Opcode Fuzzy Hash: dcc403a6f571b3fec4fd099008fd8c7b962a70b5c0a849efe306c9c81edc8744
Instruction Fuzzy Hash: C6D0E236612A267742222B25AC1DBEE6B54DE96B7134500A5AE02E2294CB60D919C7AC

Function 00C63306 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C635C4
DeleteFileW.KERNEL32(?), ref: 00C63646
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C6365C
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C6366D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C6367F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: d9a039c400d1638ddfce938a26a404eda12a255d4f09ed3fb2251a6dfc8f89a4
Instruction ID: 665f7d5fe5acc2220715ea659b6d6aa90a70a97cbf24e0be7f8f72a34ae7e952
Opcode Fuzzy Hash: d9a039c400d1638ddfce938a26a404eda12a255d4f09ed3fb2251a6dfc8f89a4
Instruction Fuzzy Hash: D2B14F72D00119ABDF21DBA4CC85EEEBBBDEF49350F1040A6F60AE7151EA349B449F61

Function 00C7ADE7 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00C7AE87
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C7AE95
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C7AEC8
CloseHandle.KERNEL32(?), ref: 00C7B09D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 502a72c5a268e70dc33489739b70b6fbd2fec8eccd2e057de03b3234738606c9
Instruction ID: e9024364e0b75ac40e8088d05a4d9fdeca2c09f69ed3941ead3c06ad8daa6607
Opcode Fuzzy Hash: 502a72c5a268e70dc33489739b70b6fbd2fec8eccd2e057de03b3234738606c9
Instruction Fuzzy Hash: A4A190B1A04301AFE720DF24C886B2AB7E5AF44714F54885DF9A9DB2D2DB71ED44CB81

Function 00C7C429 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C7D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7C10E,?,?), ref: 00C7D415
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D451
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4C8
Part of subcall function 00C7D3F8: _wcslen.LIBCMT ref: 00C7D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C7C505
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C7C560
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C7C5C3
RegCloseKey.ADVAPI32(?,?), ref: 00C7C606
RegCloseKey.ADVAPI32(00000000), ref: 00C7C613

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 56d54b97b6cbd809630a83467923525df1e59327cc37c02676f1a306aba9bc39
Instruction ID: fff6b0eb377dd8ee57bf3c19372ce8408bf56a61241240537bdd5cb02f1ad904
Opcode Fuzzy Hash: 56d54b97b6cbd809630a83467923525df1e59327cc37c02676f1a306aba9bc39
Instruction Fuzzy Hash: 71618171108246AFD714DF14C4D0E2ABBE5FF84308F54859CF59A8B292DB31ED45DB92

Function 00C5ED12 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C5D7CD,?), ref: 00C5E714

Part of subcall function 00C5E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C5D7CD,?), ref: 00C5E72D

Part of subcall function 00C5EAB0: GetFileAttributesW.KERNEL32(?,00C5D840), ref: 00C5EAB1

lstrcmpiW.KERNEL32(?,?), ref: 00C5ED8A
MoveFileW.KERNEL32(?,?), ref: 00C5EDC3
_wcslen.LIBCMT ref: 00C5EF02
_wcslen.LIBCMT ref: 00C5EF1A
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00C5EF67

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 81d550eb2d462b0180a60b1c000d2ddb12c1e1027a99f026fdd8b292fe1d3323
Instruction ID: eb7dce2006f1984757bd0d9627c6a650df9f16e223dc5120e87bf8f1659b0259
Opcode Fuzzy Hash: 81d550eb2d462b0180a60b1c000d2ddb12c1e1027a99f026fdd8b292fe1d3323
Instruction Fuzzy Hash: 85515EB60083849BC728EB90D8919DBB3ECAF85351F40092EF695D3191EF71A6CC975A

Function 00C59517 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C59534
VariantClear.OLEAUT32 ref: 00C595A5
VariantClear.OLEAUT32 ref: 00C59604
VariantClear.OLEAUT32(?), ref: 00C59677
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00C596A2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 616145a6915a981db8eb491a9e4b2a605aaa0c3770cf40d0944614050dd8c0ad
Instruction ID: 2b42875a4bc742462f888a25792cede479c6146f2fc1397f8c97f3c43ea09ecb
Opcode Fuzzy Hash: 616145a6915a981db8eb491a9e4b2a605aaa0c3770cf40d0944614050dd8c0ad
Instruction Fuzzy Hash: 6D5144B5A00219EFCB10CF68C884AAAB7F9FF89310B158559F91ADB310E730E955CB94

Function 00C69540 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C695F3
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00C6961F
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C69677
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C6969C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C696A4

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: b7a08d07c890f520e40b4f31c484c3526c35c3a47e706dd4b3062f0fa9ca0fbe
Instruction ID: 0b3fd6f4aa4214b4bea7d7a5f4a4c40ad6714113ef7bfc6f8a0f33297cf449a9
Opcode Fuzzy Hash: b7a08d07c890f520e40b4f31c484c3526c35c3a47e706dd4b3062f0fa9ca0fbe
Instruction Fuzzy Hash: 58512B35A00219AFCF15DF54C881AADBBF5FF49314F048098E95AAB362CB35ED45CB90

Function 00C79941 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00C7999D
GetProcAddress.KERNEL32(00000000,?), ref: 00C79A2D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C79A49
GetProcAddress.KERNEL32(00000000,?), ref: 00C79A8F
FreeLibrary.KERNEL32(00000000), ref: 00C79AAF

Part of subcall function 00C0F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00C61A02,?,7529E610), ref: 00C0F9F1
Part of subcall function 00C0F9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00C50354,00000000,00000000,?,?,00C61A02,?,7529E610,?,00C50354), ref: 00C0FA18

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f703f9f0887fdd7929d3fba95029a95793239dc272a3f436b3536fa273b3a997
Instruction ID: bcdfed9ea6474bd04f937e63b837700f14df14892120e3355b26ffa77b347828
Opcode Fuzzy Hash: f703f9f0887fdd7929d3fba95029a95793239dc272a3f436b3536fa273b3a997
Instruction Fuzzy Hash: 1C5136356012099FCB05DF68C485DADBBF0FF09324B14C1A8E91A9B762D731EE86CB91

Function 00C875AE Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00C8766B
SetWindowLongW.USER32(?,000000EC,?), ref: 00C87682
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00C876AB
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00C6B5BE,00000000,00000000), ref: 00C876D0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00C876FF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: fb6c06cdc6101d21c1b4eabced37871c77796dd75329eeae962e2ac962d2ff14
Instruction ID: 920e5a4d410ffb61fa34c78f858f99c8dc3d7b752e98b47ccd685c55c41e5a87
Opcode Fuzzy Hash: fb6c06cdc6101d21c1b4eabced37871c77796dd75329eeae962e2ac962d2ff14
Instruction Fuzzy Hash: 3041B135A08504AFD725AF6CCC48FAA7BA5EB05354F250364F829A72E0F670EE50D758

Function 00C223C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C22433
_free.LIBCMT ref: 00C22453

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a86517ea671585b7a540cdd9c1d9a8aa3821f8bbac6e08cff0c0351610991ef7
Instruction ID: d8da71ca28182904d5dd6d38b5189a6db3e8af17a4f42741d3de94c419d797d8
Opcode Fuzzy Hash: a86517ea671585b7a540cdd9c1d9a8aa3821f8bbac6e08cff0c0351610991ef7
Instruction Fuzzy Hash: 1841D432A00210AFCB24EF78D881A9DB3E5EF89314F254569E515EB751DB31EE41DB80

Function 00BF19CD Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BF19E1
ScreenToClient.USER32(00000000,?), ref: 00BF19FE
GetAsyncKeyState.USER32(00000001), ref: 00BF1A23
GetAsyncKeyState.USER32(00000002), ref: 00BF1A3D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6aba3eb2fcdc3323ba25d347ffeb6d6fdeaacbf9c28e6722123f3c5498ec00df
Instruction ID: b5aa0a64c1e8f7d6d12d38dbd32f0902dd67561959f70b119ada3aefea0f714c
Opcode Fuzzy Hash: 6aba3eb2fcdc3323ba25d347ffeb6d6fdeaacbf9c28e6722123f3c5498ec00df
Instruction Fuzzy Hash: A1416D71A0414AFFDF15AF68C844BFEB7B4FB05324F20865AE439A3290D7346A54DB91

Function 00C642B9 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00C64310
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00C64367
TranslateMessage.USER32(?), ref: 00C64390
DispatchMessageW.USER32(?), ref: 00C6439A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C643AB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 3758190ce61f49f930ede3a0e98fe26a50c572630c4cef25c09905d2c4b9bf93
Instruction ID: 6a4d35f855a0060f305b506161a43e1b6c05e91f047ddd375b86ed0a57003fec
Opcode Fuzzy Hash: 3758190ce61f49f930ede3a0e98fe26a50c572630c4cef25c09905d2c4b9bf93
Instruction Fuzzy Hash: 5B31A370504386DEEB3DDB75D8C9FBA3BA8AB01305F044579E4B2C22B0E7B49985CB25

Function 00C5224E Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C52262
PostMessageW.USER32(00000001,00000201,00000001), ref: 00C5230E
Sleep.KERNEL32(00000000,?,?,?), ref: 00C52316
PostMessageW.USER32(00000001,00000202,00000000), ref: 00C52327
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00C5232F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: db9dc1f7ca13c34405408de60061f93bd9f98040e9dbe52578d49ea0bdc105ab
Instruction ID: 23947e82014b921ac7f5c5b543e645b228c92c01bc15f132526f1f474a092b17
Opcode Fuzzy Hash: db9dc1f7ca13c34405408de60061f93bd9f98040e9dbe52578d49ea0bdc105ab
Instruction Fuzzy Hash: A031D375900219EFDB00CFA8CD88BDE3BB5EB05325F004215FD26A72D0C370AA84DB54

Function 00C6D95F Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00C6CC63,00000000), ref: 00C6D97D
InternetReadFile.WININET(?,00000000,?,?), ref: 00C6D9B4
GetLastError.KERNEL32(?,00000000,?,?,?,00C6CC63,00000000), ref: 00C6D9F9
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C6CC63,00000000), ref: 00C6DA0D
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C6CC63,00000000), ref: 00C6DA37

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: dbaba9c36655f6b9162fbbd33a063b32bd9d7e761d4e064f26e07151f291ea3d
Instruction ID: 8527755166799dcd347742dc2b4733915e612cd46ebc0c0887de12834211a145
Opcode Fuzzy Hash: dbaba9c36655f6b9162fbbd33a063b32bd9d7e761d4e064f26e07151f291ea3d
Instruction Fuzzy Hash: 89314B71A04205EFDB20DFA6D8C4AAEB7F8EF04354B20442EE557D6151DB30AE41AB60

Function 00C861A5 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C861E4
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C8623C
_wcslen.LIBCMT ref: 00C8624E
_wcslen.LIBCMT ref: 00C86259
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C862B5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 30198edabec76115449f8a8a51003aa290c234197bae32bc3f176910b91e08d6
Instruction ID: 3c245dd201fcde8bdb119d21e1ade4a4c81e525de5ff0ff3fa83750aff9bf7b2
Opcode Fuzzy Hash: 30198edabec76115449f8a8a51003aa290c234197bae32bc3f176910b91e08d6
Instruction Fuzzy Hash: B62196759002189ADB21EFA4CC84EEE77B9FF05328F104256FA25EB1C4D7709A85DF54

Function 00C7138D Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C713AE
GetForegroundWindow.USER32 ref: 00C713C5
GetDC.USER32(00000000), ref: 00C71401
GetPixel.GDI32(00000000,?,00000003), ref: 00C7140D
ReleaseDC.USER32(00000000,00000003), ref: 00C71445

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: e641ee9fcdf0aa23fd27315044938344ca7853f7b459ba28ff9e09f2e5a24ccf
Instruction ID: 7fa29b4fd4d942b934297fec83a6851b74fe0813d199a3bb06ef02e43b818800
Opcode Fuzzy Hash: e641ee9fcdf0aa23fd27315044938344ca7853f7b459ba28ff9e09f2e5a24ccf
Instruction Fuzzy Hash: 6F218136600208AFD714EF65DC88BAEBBF5EF48300B048469F95AD77A1DA70AD44DB94

Function 00C2D13D Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00C2D146
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C2D169

Part of subcall function 00C23B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00C16A79,?,0000015D,?,?,?,?,00C185B0,000000FF,00000000,?,?), ref: 00C23BC5

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00C2D18F
_free.LIBCMT ref: 00C2D1A2
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00C2D1B1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 7506833d316da27750597be5245f53355ee4744c686204c8639eba5da35a6022
Instruction ID: 384651f2e7d716bfe176022a6a515d90f98f17382b03f79a61761a97a6b1fdf9
Opcode Fuzzy Hash: 7506833d316da27750597be5245f53355ee4744c686204c8639eba5da35a6022
Instruction Fuzzy Hash: 6101B1736056357F23216A666C8CE7F6A6DDED2B713140169BD06C2A80DA608D11D2B0

Function 00C56078 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00C5608D
_memcmp.LIBVCRUNTIME ref: 00C560AB
_memcmp.LIBVCRUNTIME ref: 00C560BE
_memcmp.LIBVCRUNTIME ref: 00C560D6
_memcmp.LIBVCRUNTIME ref: 00C560EE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4c9dbc00b60aefbbc33982cf9831402e3c0e2128f7e52945264353f83b43e87e
Instruction ID: 753ff5a31565c23b68208f8ea79ccad14c2ac0b7fa72b613c76133ed88bd8fe0
Opcode Fuzzy Hash: 4c9dbc00b60aefbbc33982cf9831402e3c0e2128f7e52945264353f83b43e87e
Instruction Fuzzy Hash: 1E01B5B56003057F9A1066215C42FAB735D9F92399B144021FE0A9B3C1E765EE98E2ED

Function 00C2316B Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000A,?,?,00C1F64E,00C1545F,0000000A,?,00000000,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00C23170
_free.LIBCMT ref: 00C231A5
_free.LIBCMT ref: 00C231CC
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00C231D9
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00C231E2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 349a53e037cacf38d5e27a0b7be5bb9afb18cd3acbfa75ced95e529e3c915e1c
Instruction ID: 9ffab4924d6e4b83417dbe2c41d806f8c7b44e40a16ebf3f584265147e50b485
Opcode Fuzzy Hash: 349a53e037cacf38d5e27a0b7be5bb9afb18cd3acbfa75ced95e529e3c915e1c
Instruction Fuzzy Hash: 2F0128766806703BD7127775BC86F2F266DAFC13717200538F826D29D1EE39CB129221

Function 00C508FE Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?,?,00C50C4E), ref: 00C5091B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?), ref: 00C50936
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?), ref: 00C50944
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?), ref: 00C50954
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C50831,80070057,?,?), ref: 00C50960

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 1c467eef1a91f78d61fcf4765ad7e138e3d94c85c5e6e18ec839b5272505cbfd
Instruction ID: 715bcbcc1599e93cf731c620e104e1722f73a6aed890977e23524b1321818bd6
Opcode Fuzzy Hash: 1c467eef1a91f78d61fcf4765ad7e138e3d94c85c5e6e18ec839b5272505cbfd
Instruction Fuzzy Hash: CE017C7A600205AFEB104F55DC48B9E7BADEF44763F240124FD06E2256E771DE849BA4

Function 00C5F292 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00C5F2AE
QueryPerformanceFrequency.KERNEL32(?), ref: 00C5F2BC
Sleep.KERNEL32(00000000), ref: 00C5F2C4
QueryPerformanceCounter.KERNEL32(?), ref: 00C5F2CE
Sleep.KERNEL32 ref: 00C5F30A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 4b15dd764daa5b437b13ad82f619a9ade2c93caec238746311c0028105df39cf
Instruction ID: d4af25d42f17c76aa8bb1618238626c90313c3a4dbbc180cde2131724bb355ae
Opcode Fuzzy Hash: 4b15dd764daa5b437b13ad82f619a9ade2c93caec238746311c0028105df39cf
Instruction Fuzzy Hash: CC01AD74C01619DBDF04AFA4DC4CBEEBB78FF08312F00046AD902B22A0DB309599C7A9

Function 00C51A45 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C51A60
GetLastError.KERNEL32(?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A6C
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A7B
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C514E7,?,?,?), ref: 00C51A82
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C51A99

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: ee4a4a05bfc2b71799b7c8235401a65f21d42ef3c84c3dd806e97f41a58e2b46
Instruction ID: b6934e351d80c0feb1c769cd89cd87951b1004125fe4b2548ebf65d2437c8320
Opcode Fuzzy Hash: ee4a4a05bfc2b71799b7c8235401a65f21d42ef3c84c3dd806e97f41a58e2b46
Instruction Fuzzy Hash: 230169B9601205BFDB124FA4DC4CF6E3BAEEF893A5B250414FC46C32A0DA31DD409B64

Function 00C51960 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C51976
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C51982
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C51991
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C51998
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C519AE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 641d76534a25b9f773a89903edc5de8b19dd23509bb72052911209b7efc64080
Instruction ID: 26fe28abe333c8d2c4bf0c5b190ff2f34beac7f03b24522c8b0aad19400ca210
Opcode Fuzzy Hash: 641d76534a25b9f773a89903edc5de8b19dd23509bb72052911209b7efc64080
Instruction Fuzzy Hash: FCF03C79100301ABD7214FA4EC5DF5A3B6DEF896A1F140414FD46872A0CA70DA408B64

Function 00C51900 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C51916
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C51922
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C51931
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C51938
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C5194E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4efaa7dd4896743ef74ce025c935ce7660c40c1d243a68156a067d2a59504ca5
Instruction ID: 5f5c37f3eea83a69dcf803336922da9d087ec963fa9669cb2fb4cc65fbf7ad1f
Opcode Fuzzy Hash: 4efaa7dd4896743ef74ce025c935ce7660c40c1d243a68156a067d2a59504ca5
Instruction Fuzzy Hash: CCF04979200302ABDB210FA5AC4DF5A3BADEF897A1F150414FE46DB2A1CB70DC40CB68

Function 00C60CB6 Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00C60B24,?,00C63D41,?,00000001,00C33AF4,?), ref: 00C60CCB
CloseHandle.KERNEL32(?,?,?,?,00C60B24,?,00C63D41,?,00000001,00C33AF4,?), ref: 00C60CD8
CloseHandle.KERNEL32(?,?,?,?,00C60B24,?,00C63D41,?,00000001,00C33AF4,?), ref: 00C60CE5
CloseHandle.KERNEL32(?,?,?,?,00C60B24,?,00C63D41,?,00000001,00C33AF4,?), ref: 00C60CF2
CloseHandle.KERNEL32(?,?,?,?,00C60B24,?,00C63D41,?,00000001,00C33AF4,?), ref: 00C60CFF
CloseHandle.KERNEL32(?,?,?,?,00C60B24,?,00C63D41,?,00000001,00C33AF4,?), ref: 00C60D0C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bebd9c25d0e59e4721a78cc1716974b119fc4da9eab31cb2af19cf731f9560a4
Instruction ID: 1093c2132941346932f235df17ef4ceef13f4a1dfae391129f3020ca4f002771
Opcode Fuzzy Hash: bebd9c25d0e59e4721a78cc1716974b119fc4da9eab31cb2af19cf731f9560a4
Instruction Fuzzy Hash: 87019071800B159FCB30AF66D9C0817F7F5BE602153258A3ED1A762971C7B0AA45DF81

Function 00C565AB Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C565BF
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C565D6
MessageBeep.USER32(00000000), ref: 00C565EE
KillTimer.USER32(?,0000040A), ref: 00C5660A
EndDialog.USER32(?,00000001), ref: 00C56624

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 58df53a3708c5ff114ea18b7bef342f5dec0bca453bdfd49c396f95208d0fbc5
Instruction ID: 86fedfa7161f1bc4394e8ea05f875fb6f99385308acfac928e296952aca4f5a4
Opcode Fuzzy Hash: 58df53a3708c5ff114ea18b7bef342f5dec0bca453bdfd49c396f95208d0fbc5
Instruction Fuzzy Hash: 41013674540708ABEB215F10DD4EF9A7BB8FF10706F400659F597620E1EFF4AA988B58

Function 00C2DABA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C2DAD2

Part of subcall function 00C22D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4), ref: 00C22D4E
Part of subcall function 00C22D38: GetLastError.KERNEL32(00CC1DC4,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4,00CC1DC4), ref: 00C22D60

_free.LIBCMT ref: 00C2DAE4
_free.LIBCMT ref: 00C2DAF6
_free.LIBCMT ref: 00C2DB08
_free.LIBCMT ref: 00C2DB1A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: da9c4b83755836cf96b8301daa0e794ca584637607f754fbfd155495a71d865c
Instruction ID: 1ec6e407be6769bb5eabf8078e1a085b8d27d9e94859336db0758f0ad236a439
Opcode Fuzzy Hash: da9c4b83755836cf96b8301daa0e794ca584637607f754fbfd155495a71d865c
Instruction Fuzzy Hash: F2F01D32584225BB8624EB68F986E1A77EDEE14721BA50C05F01BD7D41DB31FD80DAA4

Function 00C22610 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C2262E

Part of subcall function 00C22D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4), ref: 00C22D4E
Part of subcall function 00C22D38: GetLastError.KERNEL32(00CC1DC4,?,00C2DB51,00CC1DC4,00000000,00CC1DC4,00000000,?,00C2DB78,00CC1DC4,00000007,00CC1DC4,?,00C2DF75,00CC1DC4,00CC1DC4), ref: 00C22D60

_free.LIBCMT ref: 00C22640
_free.LIBCMT ref: 00C22653
_free.LIBCMT ref: 00C22664
_free.LIBCMT ref: 00C22675

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e3a2afeb8a35f1b713da80211537c754fae057af75cd848104622f97b75c8128
Instruction ID: e994c3dd7b806dde3dc93813d44860c49d9913964eee81a3a524cf11799e2526
Opcode Fuzzy Hash: e3a2afeb8a35f1b713da80211537c754fae057af75cd848104622f97b75c8128
Instruction Fuzzy Hash: 3EF0FEB1841231AB8B12AF95FC01F4C3B64FF257627490A1AF815D66B5DB364901FFC4

Function 00C212B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00C21469
__freea.LIBCMT ref: 00C21487

Part of subcall function 00C218A7: _free.LIBCMT ref: 00C218BF

Strings

a/p, xrefs: 00C2154E
am/pm, xrefs: 00C214EA

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 038cc3cc960952993e3895037344b46e8420442462dd78dcb1afd53969802b96
Instruction ID: 62cbaa0037c7bb378431f975bd994857eac8a11f507fdeec2817c8075f16ae3c
Opcode Fuzzy Hash: 038cc3cc960952993e3895037344b46e8420442462dd78dcb1afd53969802b96
Instruction Fuzzy Hash: 43D11275900226DACB249F68E845BFEB7B1FF65700F2C015AED269BE50D7358E80CB90

Function 00C53063 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5BDCA: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C52B1D,?,?,00000034,00000800,?,00000034), ref: 00C5BDF4

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C530AD

Part of subcall function 00C5BD95: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C52B4C,?,?,00000800,?,00001073,00000000,?,?), ref: 00C5BDBF

Part of subcall function 00C5BCF1: GetWindowThreadProcessId.USER32(?,?), ref: 00C5BD1C
Part of subcall function 00C5BCF1: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C52AE1,00000034,?,?,00001004,00000000,00000000), ref: 00C5BD2C
Part of subcall function 00C5BCF1: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C52AE1,00000034,?,?,00001004,00000000,00000000), ref: 00C5BD42

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C5311A
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C53167

Strings

@, xrefs: 00C5317F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 7477b329601f363ad6cebdceffbd82ac6648348c63930769cdd6e0e31772db20
Instruction ID: bcf23ff374a022fa36d19f47a28638d974321774bf5c8a9eb479ce44c29a6036
Opcode Fuzzy Hash: 7477b329601f363ad6cebdceffbd82ac6648348c63930769cdd6e0e31772db20
Instruction Fuzzy Hash: 0C414676900218AFDB10DBA4CD81AEEBBB8EF49741F004095FA55B7184DA706F89DBA4

Function 00C21A9E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\306780\Thus.com,00000104), ref: 00C21AD9
_free.LIBCMT ref: 00C21BA4
_free.LIBCMT ref: 00C21BAE

Strings

C:\Users\user\AppData\Local\Temp\306780\Thus.com, xrefs: 00C21AD0, 00C21AD7, 00C21B06, 00C21B3E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\306780\Thus.com
API String ID: 2506810119-2831994335
Opcode ID: b0f7a2d87616b1b9504b7b5debe6610d3c4d2cd151ef26baa7830ca3a8e62a67
Instruction ID: ae298d5774a42ea5878b3650cbd92cd9af1c7d2e4c0ae735722926b8f107d902
Opcode Fuzzy Hash: b0f7a2d87616b1b9504b7b5debe6610d3c4d2cd151ef26baa7830ca3a8e62a67
Instruction Fuzzy Hash: FA3162B1A00228EFCB21DF99EC85E9EBBFCEB95710B1841A6FC1497611E6704F41DB90

Function 00C5CB28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C5CBB1
DeleteMenu.USER32(?,00000007,00000000), ref: 00C5CBF7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00CC29C0,01156C08), ref: 00C5CC40

Strings

0, xrefs: 00C5CB8A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 8e53dd0d785a71e92a0d7d282b59b2e42e91e5704a1593f1f8028cb79e98b345
Instruction ID: 6b9f28866b20be7538e4057df36f8457849c586f700c5442fe15439aad15d049
Opcode Fuzzy Hash: 8e53dd0d785a71e92a0d7d282b59b2e42e91e5704a1593f1f8028cb79e98b345
Instruction Fuzzy Hash: 1941D4792043019FD720DF28D8C5B1AB7E4EF85715F04461EF9A9972D1C730E988CB5A

Function 00C84EB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00C8DCD0,00000000,?,?,?,?), ref: 00C84F48
GetWindowLongW.USER32 ref: 00C84F65
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C84F75

Strings

SysTreeView32, xrefs: 00C84F1A

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d5cb709e42a427905e984fd6679d6349de036c66d6d9e05cff06ddae85b9d858
Instruction ID: 3a1bff9b0d5a64b080325bbd6d5da659c4ae0af7a06946f89ee6e50e624b44d8
Opcode Fuzzy Hash: d5cb709e42a427905e984fd6679d6349de036c66d6d9e05cff06ddae85b9d858
Instruction Fuzzy Hash: 2631B23111020AAFDB249F78CC45BEA77A9EF08338F214729FA75931D0D770AD509B54

Function 00C73AAB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C73DB8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00C73AD4,?,?), ref: 00C73DD5

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C73AD7
_wcslen.LIBCMT ref: 00C73AF8
htons.WSOCK32(00000000,?,?,00000000), ref: 00C73B63

Strings

255.255.255.255, xrefs: 00C73AF2, 00C73AF7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 341803d511d7a6f3a5dc5dae0214af42649ceb0c62265f5cb91ea37803b072a3
Instruction ID: 450737127f0eb263dea2fedb701921616e740e6cef72403e556db4cfd5c6a2a3
Opcode Fuzzy Hash: 341803d511d7a6f3a5dc5dae0214af42649ceb0c62265f5cb91ea37803b072a3
Instruction Fuzzy Hash: 7731B339600281DFCB10CF69C585EA97BE0EF54314F24C159E82A8B392D731EF45E760

Function 00C84954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C849DC
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C849F0
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C84A14

Strings

SysMonthCal32, xrefs: 00C849A7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: d8dd13b9291528bfc46bc0d1801db65a2b650ffc14636774a62c4ed61526c44c
Instruction ID: d535c629d95e3c0a61b02403a2accb974761a9c69a8cb52644dbcaefb0dae32b
Opcode Fuzzy Hash: d8dd13b9291528bfc46bc0d1801db65a2b650ffc14636774a62c4ed61526c44c
Instruction Fuzzy Hash: C721BF32600229BBDF259F50CC42FEF3B69EF48728F110214FA156B0D0DAB1A8559B94

Function 00C850F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00C851A3
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00C851B1
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00C851B8

Strings

msctls_updown32, xrefs: 00C85122

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: c91c9528a024ba299305e2798d307fbc196450bcd3a973322ff886f213db3293
Instruction ID: 03cac16fc0997515ec2197502cef46bc9aa3983d6a218284789452be55f7ea3f
Opcode Fuzzy Hash: c91c9528a024ba299305e2798d307fbc196450bcd3a973322ff886f213db3293
Instruction Fuzzy Hash: B72192B5600609BFDB10DF14CC85EBB37ADEB59368B000159F911973A1CB70EC15DB64

Function 00C84253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C842DC
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C842EC
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C84312

Strings

Listbox, xrefs: 00C842AB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 72ad5734e36f6eef3376efdc406817cf32d9271619bc22c7a514879967bea7fe
Instruction ID: db00ab03ba23d8671a26a0c841e51009f88c2f80bd46c6453ec0e7d3d88a0998
Opcode Fuzzy Hash: 72ad5734e36f6eef3376efdc406817cf32d9271619bc22c7a514879967bea7fe
Instruction Fuzzy Hash: B821C232604219BBEF159F94CC84FBF3B6EEF89768F118114F9119B190CA719C5287A4

Function 00C65439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C6544D
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C654A1
SetErrorMode.KERNEL32(00000000,?,?,00C8DCD0), ref: 00C65515

Strings

%lu, xrefs: 00C654B4

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 2caa744a96a2caa613f4fa9482a37239106b53a68b21b72a8df3ab4927dad408
Instruction ID: bb8ee8ce1a232bdb68b49580a458b43d3f034b9b4742b2f481e4e3b4c6f64f95
Opcode Fuzzy Hash: 2caa744a96a2caa613f4fa9482a37239106b53a68b21b72a8df3ab4927dad408
Instruction Fuzzy Hash: B1314F75A00209AFDB10DF54C885EAE77F8EF05318F1440A9E909DB2A2DB71EE45DB61

Function 00C84C89 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C84CED
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C84D02
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C84D0F

Strings

msctls_trackbar32, xrefs: 00C84CC4

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a5f6ed5670b35541289c9172ec38a0d22be301b2dd2446aad5134cfc2a57d752
Instruction ID: d1ee5fd0a0ca74d641b6b9cb3ee1ef1e9cb6c9632736f00ffecdbe3b154cbb05
Opcode Fuzzy Hash: a5f6ed5670b35541289c9172ec38a0d22be301b2dd2446aad5134cfc2a57d752
Instruction Fuzzy Hash: 38110671240249BFEF206F65CC06FAB3BACEF85B69F110519FA51E60A0C671DC51DB24

Function 00C5389E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF8577: _wcslen.LIBCMT ref: 00BF858A

Part of subcall function 00C536F4: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C53712
Part of subcall function 00C536F4: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C53723
Part of subcall function 00C536F4: GetCurrentThreadId.KERNEL32 ref: 00C5372A
Part of subcall function 00C536F4: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00C53731

GetFocus.USER32 ref: 00C538C4

Part of subcall function 00C5373B: GetParent.USER32(00000000), ref: 00C53746

GetClassNameW.USER32(?,?,00000100), ref: 00C5390F
EnumChildWindows.USER32(?,00C53987), ref: 00C53937

Strings

%s%d, xrefs: 00C5394B

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: c804c5fad29ea864500582b61c2e2e94b023b2cbc57ab3358752f94369d29918
Instruction ID: 7a3035f50636666c78ed193dd5b14630aa78a12fb5987a401d82d19e984b80e5
Opcode Fuzzy Hash: c804c5fad29ea864500582b61c2e2e94b023b2cbc57ab3358752f94369d29918
Instruction Fuzzy Hash: 121105B56002496BCF01BF709C85BED77A9AF94344F004079BD099B292DE704A89DB24

Function 00C86321 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C86360
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C8638D
DrawMenuBar.USER32(?), ref: 00C8639C

Strings

0, xrefs: 00C8632E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 60aaafacf5fb73c4543c49e6d5c0c362ca00135fe402b27fab3b7d77e572d8db
Instruction ID: e2a40cedc3222e55666e06ac5787ca4bd7da82f7c2a52df4a0ab1ca2a81e09fc
Opcode Fuzzy Hash: 60aaafacf5fb73c4543c49e6d5c0c362ca00135fe402b27fab3b7d77e572d8db
Instruction Fuzzy Hash: 1201AD71500208AFDB10AF11DC84BEE7BB5FB45356F2080AAF90AD6160CF708A80EF20

Function 00C5096F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9423f2570821099106563df206fa942897a9d51e7e85b1b84b05a7f3248e971f
Instruction ID: 17e2f6cb92bb4f14f08f08d486f03173cf68ca8e4f5f174cefa2e15eb359fa40
Opcode Fuzzy Hash: 9423f2570821099106563df206fa942897a9d51e7e85b1b84b05a7f3248e971f
Instruction Fuzzy Hash: 3CC18B79A00206EFCB14CF94C894EAEB7B5FF48705F208598E816EB251D730EE85DB94

Function 00C241F3 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C2427E
__alldvrm.LIBCMT ref: 00C2447F
__alldvrm.LIBCMT ref: 00C244A1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction ID: 671a9cdabac206ed96381b1d018025bf732e37263a240d254fdd2886d5c7fad2
Opcode Fuzzy Hash: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction Fuzzy Hash: 0CA1AC72D003A6DFDB2ADF18E8917AEBBE4EF11310F1441ADE5A59BA91C3389E41C750

Function 00C50D26 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00C90BD4,?), ref: 00C50EE0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00C90BD4,?), ref: 00C50EF8
CLSIDFromProgID.OLE32(?,?,00000000,00C8DCE0,000000FF,?,00000000,00000800,00000000,?,00C90BD4,?), ref: 00C50F1D
_memcmp.LIBVCRUNTIME ref: 00C50F3E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 30e7251facc81d55d376b7cf9532b0438b1fc1eb3f21486b86a926e59ee37560
Instruction ID: dfda971d62b90ca828d48b729e0f0398e510aa783d5c1f7790e8e65bf8612f3e
Opcode Fuzzy Hash: 30e7251facc81d55d376b7cf9532b0438b1fc1eb3f21486b86a926e59ee37560
Instruction Fuzzy Hash: 10811C75900109EFCB04DF94C984EEEB7B9FF89315F204558E916EB250DB71AE4ACB60

Function 00C7B0DC Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C7B10C
Process32FirstW.KERNEL32(00000000,?), ref: 00C7B11A

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Process32NextW.KERNEL32(00000000,?), ref: 00C7B1FC
CloseHandle.KERNEL32(00000000), ref: 00C7B20B

Part of subcall function 00C0E36B: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00C34D73,?), ref: 00C0E395

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 6579a9d2b8f83cfe777b7ced965736f9f8a3d3ac1b7e0bfd04daeeb06866f937
Instruction ID: 491d450765a66b550f6ad9ad82a11590741b4eae8ffb8694e40231174eb84fba
Opcode Fuzzy Hash: 6579a9d2b8f83cfe777b7ced965736f9f8a3d3ac1b7e0bfd04daeeb06866f937
Instruction Fuzzy Hash: 08514A71508304AFD710EF24C886A6FBBE8FF89754F40895DF59997291DB70D908CB92

Function 00C31711 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C31840

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 10ce75b30d978f9a19d66935b5ebbf413e952a126b350ce85da4b7fc1ce803b0
Instruction ID: 295b5e296e6920243dc8b4945b72218a89dfc025d9855b6ea7ba8285ea2625a0
Opcode Fuzzy Hash: 10ce75b30d978f9a19d66935b5ebbf413e952a126b350ce85da4b7fc1ce803b0
Instruction Fuzzy Hash: 80413931A20110AFDB207FBE9C46ABE3AA4EF43730F1D4625FC29D61D1DA35494277A6

Function 00C72533 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C7255A
WSAGetLastError.WSOCK32 ref: 00C72568
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C725E7
WSAGetLastError.WSOCK32 ref: 00C725F1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 5f1e46db7a35c7e070ca608569d5fe6f6ad7ba347d8702a01c779fd4f37776de
Instruction ID: 2e8025e55172a5194d77a1f6c1d45138184dfecbc4ec89ec4468093ca5a1bddc
Opcode Fuzzy Hash: 5f1e46db7a35c7e070ca608569d5fe6f6ad7ba347d8702a01c779fd4f37776de
Instruction Fuzzy Hash: 1741B274A00204AFE720AF24C886F3A77E5AB44758F54C488FA5A8F2D3D772ED41CB90

Function 00C86CB0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C86D1A
ScreenToClient.USER32(?,?), ref: 00C86D4D
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00C86DBA

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 59ee2a7b79c283b50520ea2bab3c5f18c6683afd750d0fa0426c3eb60b39f78e
Instruction ID: a161ec437a425bd59e7ab5a5a658880bc48c037d25e378d150a5144b50a1e8b6
Opcode Fuzzy Hash: 59ee2a7b79c283b50520ea2bab3c5f18c6683afd750d0fa0426c3eb60b39f78e
Instruction Fuzzy Hash: CF510C74A00209EFCF24EF64D980AAE7BB6FF44364F10855AF9659B290D770EE81CB54

Function 00C2B79F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43e7faec8e885e26ea3f979f5627569d23f20700b28ebd7432196cd2e40103d
Instruction ID: fc32278cad3edb237cd3c3ae9f6aa945c011f58eeecc94ed84555bb855c07c4e
Opcode Fuzzy Hash: b43e7faec8e885e26ea3f979f5627569d23f20700b28ebd7432196cd2e40103d
Instruction Fuzzy Hash: 61412871A00714AFD724AF78DC41BAABBECEB88710F10852EF159DB6D1D7729E419780

Function 00C6611E Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C661C8
GetLastError.KERNEL32(?,00000000), ref: 00C661EE
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C66213
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C6623F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f1d8fd3d35105a8d422360eac637e4acb7e5277e903bc0de0415e1b2c9f7feff
Instruction ID: 73d99253bac9c129bdf0cc04a58ebb909d046e0e1c32b46a99b2d6ce6097babf
Opcode Fuzzy Hash: f1d8fd3d35105a8d422360eac637e4acb7e5277e903bc0de0415e1b2c9f7feff
Instruction Fuzzy Hash: 56414F35600615DFCF21EF15C585A2DBBF2EF89710B198488E95A9B362CB30FD45CB91

Function 00C2DC43 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00C170E1,00000000,00000000,00C18649,?,00C18649,?,00000001,00C170E1,8BE85006,00000001,00C18649,00C18649), ref: 00C2DC90
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00C2DD19
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00C2DD2B
__freea.LIBCMT ref: 00C2DD34

Part of subcall function 00C23B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00C16A79,?,0000015D,?,?,?,?,00C185B0,000000FF,00000000,?,?), ref: 00C23BC5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 5a5d30b5aa79b1c9da1f23d5b2c608466160c8e577886873f3f9bf4a15e16ab2
Instruction ID: 936de91a099921edd105de3f579dd4879ea95efd48501adfa7263f68bfad10ea
Opcode Fuzzy Hash: 5a5d30b5aa79b1c9da1f23d5b2c608466160c8e577886873f3f9bf4a15e16ab2
Instruction Fuzzy Hash: A731B332A0022AABDF249F64EC45EEE7BA5EF51710F140129FC16D7190E735CE51DBA0

Function 00C5B41E Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00C5B473
SetKeyboardState.USER32(00000080), ref: 00C5B48F
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00C5B4FD
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00C5B54F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 422d6897a5ff0781a2d8850e3158d9ff24f1c17b85395e0daafc7c2b233d7384
Instruction ID: 8c11f76648512be67c181a289f9ad22d7af31004f93e5dd8820f8cfa5ff88253
Opcode Fuzzy Hash: 422d6897a5ff0781a2d8850e3158d9ff24f1c17b85395e0daafc7c2b233d7384
Instruction Fuzzy Hash: C2315974A00208AEFF358B258805BFE7FB5AB44312F44821AF8A6561D2D3748EC9975E

Function 00C5B563 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00C5B5B8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C5B5D4
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C5B63B
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00C5B68D

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ec2e8d59e8d5fbf9a7afb79055c5e16ca71ba3afc32bf54a56faca6dbbfc5fe0
Instruction ID: 76fa7a3305bf460a218747b4c2dd997dc8b132fc067218a75a1742a47bc1ec27
Opcode Fuzzy Hash: ec2e8d59e8d5fbf9a7afb79055c5e16ca71ba3afc32bf54a56faca6dbbfc5fe0
Instruction Fuzzy Hash: 70314F349006089EFF388B2588057FEBFA5AF44312F04422AF855561D1DB74CFC99B59

Function 00C880AE Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C880D4
GetWindowRect.USER32(?,?), ref: 00C8814A
PtInRect.USER32(?,?,?), ref: 00C8815A
MessageBeep.USER32(00000000), ref: 00C881C6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 097ff5b216423d1e6f21f5ca0a3ac860e1f26a25c6f983ce8caed89c865e2f60
Instruction ID: 6492c3c05a5abafd3737f91da9dbcf59a7e06ce29c2f4d25a90b80d5077974a7
Opcode Fuzzy Hash: 097ff5b216423d1e6f21f5ca0a3ac860e1f26a25c6f983ce8caed89c865e2f60
Instruction Fuzzy Hash: 9441BD30A00214DFCB11EF58C888FADB7F5BF45318F9440A8E9159B6A1CF70E94ACB44

Function 00C82176 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C82187

Part of subcall function 00C54393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C543AD
Part of subcall function 00C54393: GetCurrentThreadId.KERNEL32 ref: 00C543B4
Part of subcall function 00C54393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C52F00), ref: 00C543BB

GetCaretPos.USER32(?), ref: 00C8219B
ClientToScreen.USER32(00000000,?), ref: 00C821E8
GetForegroundWindow.USER32 ref: 00C821EE

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 2b5e8c01f05d939250e01f9667283f84a934857f8e15822cdbf5300606d13baa
Instruction ID: 7e1884f07f3f6a317ade2891b135f5fd07cfa6befe59c84530810bc5b60ac0cc
Opcode Fuzzy Hash: 2b5e8c01f05d939250e01f9667283f84a934857f8e15822cdbf5300606d13baa
Instruction Fuzzy Hash: A63121B5D0010DAFCB04EFA5C885DBEB7F9EF48304B5044AAE515E7251DA71DE45CBA0

Function 00C5E8AC Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00BF41EA: _wcslen.LIBCMT ref: 00BF41EF

_wcslen.LIBCMT ref: 00C5E8E2
_wcslen.LIBCMT ref: 00C5E8F9
_wcslen.LIBCMT ref: 00C5E924
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00C5E92F

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 9754b9473043cb69e2d1b6dd12cdbfb1d0cb6eccb38f6a2ece4aae55742935c8
Instruction ID: 6ab16926cba01b739522f792c38b1c3c6254e0d3d1dd6233a0815041279e30d0
Opcode Fuzzy Hash: 9754b9473043cb69e2d1b6dd12cdbfb1d0cb6eccb38f6a2ece4aae55742935c8
Instruction Fuzzy Hash: 5221D375900214AFCB14AFA8D981BEEB7F8EF46350F244065E814BB281D7709F81D7E5

Function 00C89A25 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

GetCursorPos.USER32(?), ref: 00C89A5D
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C89A72
GetCursorPos.USER32(?), ref: 00C89ABA
DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 00C89AF0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 3fe4e98cc064b3f7eb1fc767e7213df323b2fb24f6014d4354545640c5448d28
Instruction ID: 135d97151c49d2a11c57cfeda135daf31f359f80936143f35fc410342433aac4
Opcode Fuzzy Hash: 3fe4e98cc064b3f7eb1fc767e7213df323b2fb24f6014d4354545640c5448d28
Instruction Fuzzy Hash: 3021BF35600018AFCF299F54CC48FFE7BB9EB0A355F584165F9168B1B1D7709A50EB60

Function 00C5DB6C Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C8DC30), ref: 00C5DBA6
GetLastError.KERNEL32 ref: 00C5DBB5
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C5DBC4
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C8DC30), ref: 00C5DC21

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 0ddb87758f1caee7f9917cec7cfd0be048a358864de3cf22e158d948d2dddf4d
Instruction ID: bb5723a757865dc45faa25c88b0ebd7eba2d27b8b47b494483e3bfc9876cadef
Opcode Fuzzy Hash: 0ddb87758f1caee7f9917cec7cfd0be048a358864de3cf22e158d948d2dddf4d
Instruction Fuzzy Hash: 472182741043059F8324EF24C84096AB7E8AE55365F100A59F8AAC72A1D730DE8ACB46

Function 00C8321E Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C832A6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C832C0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C832CE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C832DC

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 9b1720a95a70cdf64fdd8b68592d7a7e801442092d62c8b13b0f411fd9769b95
Instruction ID: e4a4149f38b7c7e0c61e3145855b5fc5194a75ed75bb6b2a3921d6bb3e2d1c5a
Opcode Fuzzy Hash: 9b1720a95a70cdf64fdd8b68592d7a7e801442092d62c8b13b0f411fd9769b95
Instruction Fuzzy Hash: 5F210331204555AFD704AB24C845F6ABB95EF81728F248258F8268B2D3C771EE82C7D8

Function 00C5825C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C596E4: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00C58271,?,000000FF,?,00C590BB,00000000,?,0000001C,?,?), ref: 00C596F3
Part of subcall function 00C596E4: lstrcpyW.KERNEL32(00000000,?,?,00C58271,?,000000FF,?,00C590BB,00000000,?,0000001C,?,?,00000000), ref: 00C59719
Part of subcall function 00C596E4: lstrcmpiW.KERNEL32(00000000,?,00C58271,?,000000FF,?,00C590BB,00000000,?,0000001C,?,?), ref: 00C5974A

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00C590BB,00000000,?,0000001C,?,?,00000000), ref: 00C5828A
lstrcpyW.KERNEL32(00000000,?,?,00C590BB,00000000,?,0000001C,?,?,00000000), ref: 00C582B0
lstrcmpiW.KERNEL32(00000002,cdecl,?,00C590BB,00000000,?,0000001C,?,?,00000000), ref: 00C582EB

Strings

cdecl, xrefs: 00C582E2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: fa20b6846f2bc0cd9d0ab033f4543d3a803cf1161e5c16401080a2ff71b67adf
Instruction ID: 4ab9529ecfb157e9cc87c728816e2ba12a5dd552a788e6eb2cf1404be152c125
Opcode Fuzzy Hash: fa20b6846f2bc0cd9d0ab033f4543d3a803cf1161e5c16401080a2ff71b67adf
Instruction Fuzzy Hash: 8611B13E200341ABCB149F38D845EBE77A9FF45751B50402AFD42C72A0EF719999D7A8

Function 00C860FF Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00C8615A
_wcslen.LIBCMT ref: 00C8616C
_wcslen.LIBCMT ref: 00C86177
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C862B5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: e7ec3d4a2c3bf7557236c6afc0a4825f2fedb6252d3a2f39cb5eee6ae36f1317
Instruction ID: 1c8c23eedfbfd6a2c101ac09d0b72595f4f6e189c9b89881362ad87b8304f261
Opcode Fuzzy Hash: e7ec3d4a2c3bf7557236c6afc0a4825f2fedb6252d3a2f39cb5eee6ae36f1317
Instruction Fuzzy Hash: D7119675600218A6DB20FFA58C85FEF777CEB11358F10412AFA11D6082E7B0CA44DB68

Function 00C22079 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d597217c0163e2b310171683f1d422ef12c7f485610e142e118878e289fbf0
Instruction ID: 804427a7505b9271929d6fd8595c7f62a3b14f0740de4693bdc33c517b14532c
Opcode Fuzzy Hash: 30d597217c0163e2b310171683f1d422ef12c7f485610e142e118878e289fbf0
Instruction Fuzzy Hash: 9501ADB22092267EF6212AB8BCC0F2B670DDF913B8B340325F532A15D1DE608D80E660

Function 00C52374 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C52394
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C523A6
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C523BC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C523D7

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 63bb5fb06465207fed550b8ea968c0ce98499e11619ab9c0b23ed8de56180429
Instruction ID: bb57c0294e2e71cc0da0c2209bf771e6cbfbebfff3dbc9786e062a511b00d1ea
Opcode Fuzzy Hash: 63bb5fb06465207fed550b8ea968c0ce98499e11619ab9c0b23ed8de56180429
Instruction Fuzzy Hash: 1111093A900218FFEF119BA5CD85F9EBBB8FB09751F200091EA11B7290D6716E54DB98

Function 00BF1AAC Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00BF249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00BF24B0

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00BF1AF4
GetClientRect.USER32(?,?), ref: 00C331F9
GetCursorPos.USER32(?), ref: 00C33203
ScreenToClient.USER32(?,?), ref: 00C3320E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: d2a7c815076e0748d1da541ae73c1b43383d48a88c7cfafb08f758bd8436983d
Instruction ID: b9d0199eb303faedc1d05b80b9586c792d68a40e9e07f9904003291db23641ce
Opcode Fuzzy Hash: d2a7c815076e0748d1da541ae73c1b43383d48a88c7cfafb08f758bd8436983d
Instruction Fuzzy Hash: 7B114C71A0101DEBCB00DFA8C985AFE77B8EB05354F100892FA22E3180D771BB95DBA5

Function 00C5EAED Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C5EB14
MessageBoxW.USER32(?,?,?,?), ref: 00C5EB47
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C5EB5D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C5EB64

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: db1bec888e7fb4ca862866a21c0cd5e8ceae9ea25afb5a26eefe7efb0ff6ae22
Instruction ID: 51f7faf5d4400ce8ce5b4e16b36a0daf8c133634909a599ff2964be5c3820f58
Opcode Fuzzy Hash: db1bec888e7fb4ca862866a21c0cd5e8ceae9ea25afb5a26eefe7efb0ff6ae22
Instruction Fuzzy Hash: DB112BBA900258BBC705ABA8DC09FDE7FADEB45322F144256F826D32E0D6748E448764

Function 00C1D53C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00C1D369,00000000,00000004,00000000), ref: 00C1D588
GetLastError.KERNEL32 ref: 00C1D594
__dosmaperr.LIBCMT ref: 00C1D59B
ResumeThread.KERNEL32(00000000), ref: 00C1D5B9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 5ab516dab9a0f90b2a1499d02416148d47d3ca0bca0e94f2c362b3123a2f8d63
Instruction ID: e6eb75c186075ff0c42b632fe5803e1d3c348d31dd394c537abb513bb30f625b
Opcode Fuzzy Hash: 5ab516dab9a0f90b2a1499d02416148d47d3ca0bca0e94f2c362b3123a2f8d63
Instruction Fuzzy Hash: 7001C472404214BBCB116BA5EC05BEE7B6AEF83335F100259F927861E0DB709981F7A1

Function 00BF7873 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BF78B1
GetStockObject.GDI32(00000011), ref: 00BF78C5
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BF78CF

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: a944988429960973d9b2d6045f9b29708cfdd9a7dc16a2fb09b0f0e702803d76
Instruction ID: a0601cbe5f5b4f673b1f1e6383456291a5ae0aa795da882de1cf60479ab7835e
Opcode Fuzzy Hash: a944988429960973d9b2d6045f9b29708cfdd9a7dc16a2fb09b0f0e702803d76
Instruction Fuzzy Hash: DD117972505548BFEB025F919C58FEA7BA9FF083A4F040195FA0252160DB319C60EBA0

Function 00C233E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000364,00000000,00000000,?,00C2338D,00000364,00000000,00000000,00000000,?,00C235FE,00000006,FlsSetValue), ref: 00C23418
GetLastError.KERNEL32(?,00C2338D,00000364,00000000,00000000,00000000,?,00C235FE,00000006,FlsSetValue,00C93260,FlsSetValue,00000000,00000364,?,00C231B9), ref: 00C23424
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00C2338D,00000364,00000000,00000000,00000000,?,00C235FE,00000006,FlsSetValue,00C93260,FlsSetValue,00000000), ref: 00C23432

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 5a4e31efe6d3739f55f6b59f41d31b317c34b5bcdc24f2935c3beefe917e6f4b
Instruction ID: c9037236ac18c2c23e4d75f6ef7ff62bd090140f8e7eedf8479b6e3ce19d96f9
Opcode Fuzzy Hash: 5a4e31efe6d3739f55f6b59f41d31b317c34b5bcdc24f2935c3beefe917e6f4b
Instruction Fuzzy Hash: F501F732611272ABCB229B79BC44F5A3F58BF15B717200660FA16D7580C728DF01C7E4

Function 00C5BA6F Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00C5B69A,?,00008000), ref: 00C5BA8B
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C5B69A,?,00008000), ref: 00C5BAB0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00C5B69A,?,00008000), ref: 00C5BABA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C5B69A,?,00008000), ref: 00C5BAED

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: a395d378a1fef8ee121ae307afa6cd13a5f504d2a1872e1bcfade789457f4bfd
Instruction ID: 41d784c391374ecb301df89ef9af9772edd4f8e2e2b2c2d290feb88a197c6332
Opcode Fuzzy Hash: a395d378a1fef8ee121ae307afa6cd13a5f504d2a1872e1bcfade789457f4bfd
Instruction Fuzzy Hash: B9115E35C00619E7CF00EFA5E9497EEBF78FF09712F104095E941B2190DB305A94DB69

Function 00C8886F Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C8888E
ScreenToClient.USER32(?,?), ref: 00C888A6
ScreenToClient.USER32(?,?), ref: 00C888CA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C888E5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 1680cd8ea7eff47de4f94d722fcbd2a3b1824a942275231ae76794b5fd33e5db
Instruction ID: 07aa39311ff3bd2513ef5296befed51ad8f00aa2fa5f4f4e1e78ebb1f00007c0
Opcode Fuzzy Hash: 1680cd8ea7eff47de4f94d722fcbd2a3b1824a942275231ae76794b5fd33e5db
Instruction Fuzzy Hash: 501140B9D0020DAFDB41DFA8C884AEEBBB5FB08314F508166E925E2650E735AA54CF54

Function 00C536F4 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C53712
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C53723
GetCurrentThreadId.KERNEL32 ref: 00C5372A
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00C53731

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 90f4d55dab33082845d0793c669be2c542329e9934021382cd9b0bc6e973ccc5
Instruction ID: d5d8c383155af96b3c0174699b49ddaf4f17d5d5e4b9fd4762f04c33f6559e08
Opcode Fuzzy Hash: 90f4d55dab33082845d0793c669be2c542329e9934021382cd9b0bc6e973ccc5
Instruction Fuzzy Hash: DDE06DB1501268BADA2017A2AC4DFEF7F6CDF46BF2F000015F506D20C0EAA08A84C3B8

Function 00C892BF Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BF1F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BF1F87
Part of subcall function 00BF1F2D: SelectObject.GDI32(?,00000000), ref: 00BF1F96
Part of subcall function 00BF1F2D: BeginPath.GDI32(?), ref: 00BF1FAD
Part of subcall function 00BF1F2D: SelectObject.GDI32(?,00000000), ref: 00BF1FD6

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00C892E3
LineTo.GDI32(?,?,?), ref: 00C892F0
EndPath.GDI32(?), ref: 00C89300
StrokePath.GDI32(?), ref: 00C8930E

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b8437c54ca0b64782bad20d1c401e1c1ee4eac300cdb3bfa642e2a88673148c4
Instruction ID: 9e6a3919861a52ea4841ae07eeaf3dee1cbe9afb2b29bf329a0542fd512b5b79
Opcode Fuzzy Hash: b8437c54ca0b64782bad20d1c401e1c1ee4eac300cdb3bfa642e2a88673148c4
Instruction Fuzzy Hash: 9BF05E31005259BBDB126F54AC0EFDE3F6AAF0A324F048000FA16250E1C77556219BA9

Function 00BF21A0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BF21BC
SetTextColor.GDI32(?,?), ref: 00BF21C6
SetBkMode.GDI32(?,00000001), ref: 00BF21D9
GetStockObject.GDI32(00000005), ref: 00BF21E1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 96afa6cf17586bb97e74cfb3358aa5d3316c4b8ee314bf61b1ea0d62a85f3164
Instruction ID: e3236cd925fa4d8594ca95cc2a11fca11de94fcf3726aef0be5110e0c6d78ae4
Opcode Fuzzy Hash: 96afa6cf17586bb97e74cfb3358aa5d3316c4b8ee314bf61b1ea0d62a85f3164
Instruction Fuzzy Hash: 56E06D31240680AEDB216B74AC0DBEC3B61AF12336F04821AF7BB980E0C77286449B15

Function 00C4EC36 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C4EC36
GetDC.USER32(00000000), ref: 00C4EC40
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C4EC60
ReleaseDC.USER32(?), ref: 00C4EC81

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 7744ecd0f8715b5e1bebe27724f85c36992b5cae20d77dd923d8edf68593d6bc
Instruction ID: 9388c74363ec4a362a89f8b6b45d6eba65baa64d19a1eb0ab0e658c27f16d6bc
Opcode Fuzzy Hash: 7744ecd0f8715b5e1bebe27724f85c36992b5cae20d77dd923d8edf68593d6bc
Instruction Fuzzy Hash: BBE09A75800209EFCB41AFA1D948B6DBBF5FF58311F108859F95AE3290D7785941EF14

Function 00C4EC4A Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C4EC4A
GetDC.USER32(00000000), ref: 00C4EC54
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C4EC60
ReleaseDC.USER32(?), ref: 00C4EC81

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: eb2eb5da5b682fec0836f70a9ec93245895ff0dcfb758d8ec38f4699e7e94fcc
Instruction ID: 91465b1d7de00ea12f0fe2bf655fcab86763d545b1dd5c2c1da664d9275817b5
Opcode Fuzzy Hash: eb2eb5da5b682fec0836f70a9ec93245895ff0dcfb758d8ec38f4699e7e94fcc
Instruction Fuzzy Hash: ACE09A75C00209EFCB519FA0D948B6DBBB5AF58311B108859F95AE3290D7785901DF14

Function 00C657CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF41EA: _wcslen.LIBCMT ref: 00BF41EF

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00C65919

Strings

*, xrefs: 00C65855
LPT, xrefs: 00C65840

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 9e088f6ee9b6a8272a8a3ad8c0e24b700badfbe1882d02926fe52ea651d3ae38
Instruction ID: 3eb5c4cabbdb06aad6ef6565f0923a8149b957c9e3aee7cc327bfc990015c5a2
Opcode Fuzzy Hash: 9e088f6ee9b6a8272a8a3ad8c0e24b700badfbe1882d02926fe52ea651d3ae38
Instruction Fuzzy Hash: 36916F75A00604DFCB24DF54C4D4EAABBF1AF45314F288099E8559F3A2C771EE86DB90

Function 00C1E5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00C1E67D

Strings

pow, xrefs: 00C1E655, 00C1E672

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: fd2cbf4eb2e15b03f759d9f95835d1d871f4ef8a4234d3fc23e52538b5dfbaab
Instruction ID: b6f0d83d26957c53e3b2dd428e8b0d2cab1bd69b4681ed324bc26dbceb070577
Opcode Fuzzy Hash: fd2cbf4eb2e15b03f759d9f95835d1d871f4ef8a4234d3fc23e52538b5dfbaab
Instruction Fuzzy Hash: 1A51CF71E0A106D6D7117714ED013EE3BA0AB51700F704D59F8B1C26E8DF358EEABA86

Function 00C0A8EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00C0A916

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 668d695f2df60d46a13d618b54ae4665ec988c5361e279c8f43dc188ea445ca3
Instruction ID: c37fd1f5f451340876dbef52f1593848f47dd1673104fc1862156d93d3b5956a
Opcode Fuzzy Hash: 668d695f2df60d46a13d618b54ae4665ec988c5361e279c8f43dc188ea445ca3
Instruction Fuzzy Hash: 39512031A0434ADFDF25DF28C451ABE7BA4BF15310F644059F9A19B2D0DB349E8ACB61

Function 00C0F6CA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C0F6DB
GlobalMemoryStatusEx.KERNEL32(?), ref: 00C0F6F4

Strings

@, xrefs: 00C0F6E8

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 77003594025251a1b3555db462ed77a9bfb195fe5913791d3908cf561e0b5d74
Instruction ID: c076f503be96050fed7609c61a8f5c370333e60c9509d5b01ca94bc4de981595
Opcode Fuzzy Hash: 77003594025251a1b3555db462ed77a9bfb195fe5913791d3908cf561e0b5d74
Instruction Fuzzy Hash: 925139714087489BD320AF14DC86BBFB7E8FF95704F81489DF2D9421A1DB708569CB66

Function 00C761A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?), ref: 00C7623D
_wcslen.LIBCMT ref: 00C76249

Strings

CALLARGARRAY, xrefs: 00C76243, 00C76248

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 30f4a587a0f18e95ae0b095c4f39d4ea3026f60df2d2cb748623b06c6881fcd6
Instruction ID: cd6ce7057af43966fae2532f150350801c72f3375d99b8a3b8277502e98595b0
Opcode Fuzzy Hash: 30f4a587a0f18e95ae0b095c4f39d4ea3026f60df2d2cb748623b06c6881fcd6
Instruction Fuzzy Hash: C641E271A006199FCB04DFA5C8829FEBBF5FF58324F108069E51AA7252E7709E81CB90

Function 00C6DB39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C6DB75
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C6DB7F

Strings

|, xrefs: 00C6DB50

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 31acad43944ecf7fcb2457bc51b7f039302acf6d56b55fd43234e52a994ff443
Instruction ID: 9d8109523622b279255b7f6e249110f7c3a01777997713bac8ea24237eb7210a
Opcode Fuzzy Hash: 31acad43944ecf7fcb2457bc51b7f039302acf6d56b55fd43234e52a994ff443
Instruction Fuzzy Hash: 2C315971D01109ABCF15EFA0CC85AEEBFB8FF08344F000069F919A6166EB719A06DB50

Function 00C84008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C840BD
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C840F8

Strings

static, xrefs: 00C84058

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 57278d91ce63f19b7df34daf2d1b6ada604bdbd482532a52a102086f58699d24
Instruction ID: a96c6f10eb8bf3660ae04465e416d9628a4d7b473eb7e3a030fbc4451f76a0ea
Opcode Fuzzy Hash: 57278d91ce63f19b7df34daf2d1b6ada604bdbd482532a52a102086f58699d24
Instruction Fuzzy Hash: 88319E71100605AADB24EF68CC80FFB73A9FF48768F008619FAA587190DB71AD81DB64

Function 00C84FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00C850BD
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C850D2

Strings

', xrefs: 00C8502C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: bebd101acc093bdf0106d518dd7757b4f40b182ac7dc6477f21d78c2ec4dfbbb
Instruction ID: 5316ca7b088ef62f05812276187964ced89e0e33efe67ad548fc95b60aefb922
Opcode Fuzzy Hash: bebd101acc093bdf0106d518dd7757b4f40b182ac7dc6477f21d78c2ec4dfbbb
Instruction Fuzzy Hash: A0311974A0170A9FDB14DFA9C980BDE7BB5FF49304F10406AE904AB391D7B1AA45CF94

Function 00C83C8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C83D18
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C83D23

Strings

Combobox, xrefs: 00C83CE5

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 69a189f0ddd6f71cc629c4a209aa0d97f6c0d99f0f0675905abd642421bbb55d
Instruction ID: d6dc26fdb85d486398b1f753979566a6bc87798d6a200a2e594909f7e83edcef
Opcode Fuzzy Hash: 69a189f0ddd6f71cc629c4a209aa0d97f6c0d99f0f0675905abd642421bbb55d
Instruction Fuzzy Hash: FA11C471710248BFEF11AF54CC80FFB3BAAEB847A8F105225F9259B290D671DE5187A4

Function 00C841AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BF7873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BF78B1
Part of subcall function 00BF7873: GetStockObject.GDI32(00000011), ref: 00BF78C5
Part of subcall function 00BF7873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BF78CF

GetWindowRect.USER32(00000000,?), ref: 00C84216
GetSysColor.USER32(00000012), ref: 00C84230

Strings

static, xrefs: 00C841F3

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 85f40d42ca8ffedab9b904930bad3fcbe1a7bed9ea47b40d170fb76a509fbf65
Instruction ID: 92b8454d7a83839bd63a8057f4a1dd9e09e7012f4c0b1560256a062ec3a98f84
Opcode Fuzzy Hash: 85f40d42ca8ffedab9b904930bad3fcbe1a7bed9ea47b40d170fb76a509fbf65
Instruction Fuzzy Hash: 341129B261020AAFDB00EFA8CC45AFE7BE8EB08358F014514FD65D3150D634E8519B54

Function 00C6D763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C6D7C2
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C6D7EB

Strings

<local>, xrefs: 00C6D7AB

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 9399a9f29bbdebaba9ac1f8261e06d38f555df11a86fa62dec13ef2d5820ff3a
Instruction ID: 65af97d9c25c42da8a4ea381ff1c531cb07bc4d3e17c4117a797f0c0172f8743
Opcode Fuzzy Hash: 9399a9f29bbdebaba9ac1f8261e06d38f555df11a86fa62dec13ef2d5820ff3a
Instruction Fuzzy Hash: 10110271B01232BED7344B628CC9FE7BE9CEB127A4F00422AB51A92184D2649940D2F2

Function 00C575ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

CharUpperBuffW.USER32(?,?,?), ref: 00C5761D
_wcslen.LIBCMT ref: 00C57629

Strings

STOP, xrefs: 00C57623, 00C57628

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 3f83729c2b897dc2b137f80ba8c2266ab7433b65994b99308643830909647d86
Instruction ID: f3337b1a12446cb3e4f526dcd3037096c18881754b9fece9d3d8c86049309759
Opcode Fuzzy Hash: 3f83729c2b897dc2b137f80ba8c2266ab7433b65994b99308643830909647d86
Instruction Fuzzy Hash: 0F01C43660492A8BCB109EBDEC50DBF77B5AB607517500624F83193191EF35DAC89694

Function 00C5262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C52699

Strings

ListBox, xrefs: 00C52663
ComboBox, xrefs: 00C52638

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 172d152acf3ef855109fa39b088253f37dd74a48502e489c4f144876e2730f93
Instruction ID: c6a9d1ce5fb037e73bc722c1fbe6db1250c32e8fd92d31dd77b4ae5ea2279918
Opcode Fuzzy Hash: 172d152acf3ef855109fa39b088253f37dd74a48502e489c4f144876e2730f93
Instruction Fuzzy Hash: 9801F179640218ABCB08ABA0CC41CFE33F8EF46321B400629B832932C1EF31594C9658

Function 00C52525 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C52593

Strings

ListBox, xrefs: 00C5255D
ComboBox, xrefs: 00C52532

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 79002adbaff43c8f3d937effd808442ecefad4bdb12e9712f57af06d2ef25b43
Instruction ID: f2bb558382575cce9a30c68947da64037342008aeded830a073eeec6b0b2766e
Opcode Fuzzy Hash: 79002adbaff43c8f3d937effd808442ecefad4bdb12e9712f57af06d2ef25b43
Instruction Fuzzy Hash: 3D01A7796401087BCB08EB90C962EFF77E8DF46342F9000297D12A3281EB109E4C97B9

Function 00C525A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C52615

Strings

ListBox, xrefs: 00C525E1
ComboBox, xrefs: 00C525B6

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e47cd78307cd6691a2373e7153b437081e8f8396e825166efe87ec2e63d71ef4
Instruction ID: aecc3fcb4cc308297abf85bd0778044617cde70df3069c39e861c4dce3555779
Opcode Fuzzy Hash: e47cd78307cd6691a2373e7153b437081e8f8396e825166efe87ec2e63d71ef4
Instruction Fuzzy Hash: BD01D6B9A4010877CB09EBA0C901EFF77F89F06341F500025BD02A3281EF618E4CD6BA

Function 00C526B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BFB329: _wcslen.LIBCMT ref: 00BFB333

Part of subcall function 00C545FD: GetClassNameW.USER32(?,?,000000FF), ref: 00C54620

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00C52720

Strings

ListBox, xrefs: 00C526ED
ComboBox, xrefs: 00C526C2

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: d6bf82ec6804b7f3b9b2e2e4e14b6fa02be1ab815ce1d9f6d19c802805133496
Instruction ID: 48d6bf624904ba7646f642ef67caa2184d424e4d45665787ec18de882ec3623a
Opcode Fuzzy Hash: d6bf82ec6804b7f3b9b2e2e4e14b6fa02be1ab815ce1d9f6d19c802805133496
Instruction Fuzzy Hash: 81F0F479A4021867CB08E7A4CC41FFE73FCAF06391F400925B822A32C1DF60594C8268

Function 00C51461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00C5146F

Strings

Error allocating memory., xrefs: 00C51468
AutoIt, xrefs: 00C51463

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: ae6a1491166dcd91ae0ad332555467424d73f03d1fc02fa0aeaff40fa74b06f1
Instruction ID: 55ebf144570219d2aa4b012499ad3a6dc75c134f9410a55784968013ba7009a7
Opcode Fuzzy Hash: ae6a1491166dcd91ae0ad332555467424d73f03d1fc02fa0aeaff40fa74b06f1
Instruction Fuzzy Hash: 8BE0D83228472836D6103794AC03FCD77C58F05B66F31482EFB59654C24EE224D0639D

Function 00C110B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C0FAD4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00C110E2,?,?,?,00BF100A), ref: 00C0FAD9

IsDebuggerPresent.KERNEL32(?,?,?,00BF100A), ref: 00C110E6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BF100A), ref: 00C110F5

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00C110F0

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 06dd8e87ff8f3a3e0c6ff6e06fbc6b4a36de1ae1425a9fdb2c08aae7b8ee5e32
Instruction ID: fd296676ed34248d5f7d84132ba4cba3def07af64f76d8c5a20ef5753f9cbb5f
Opcode Fuzzy Hash: 06dd8e87ff8f3a3e0c6ff6e06fbc6b4a36de1ae1425a9fdb2c08aae7b8ee5e32
Instruction Fuzzy Hash: 6FE06D706007518FD7309F28D90878ABBE4AB04301F188D6CE986C2691DBB8E884EBA1

Function 00C639D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00C639F0
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00C63A05

Strings

aut, xrefs: 00C639F9

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 5e6c41483820b0b8206edd240c96c081b49b3a97f4765c5fda84c9f36a205113
Instruction ID: 900d54036c74d2398761bffdf491167296665753bd75d63b950484c9c0fc5f12
Opcode Fuzzy Hash: 5e6c41483820b0b8206edd240c96c081b49b3a97f4765c5fda84c9f36a205113
Instruction Fuzzy Hash: 9AD05EB250032867DA60A7649C0EFCF7B6CDB44721F0002A1BA56920D1DAB0DA85CB94

Function 00C82DF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C82E08
PostMessageW.USER32(00000000), ref: 00C82E0F

Part of subcall function 00C5F292: Sleep.KERNEL32 ref: 00C5F30A

Strings

Shell_TrayWnd, xrefs: 00C82E01

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: c2020dff14a11365077532462e163d058f742f9c9ff930a7caa389e43913f5e6
Instruction ID: 6c0592cc6c26333cb8da23c4ff84ea2d5389cf73be19b38a244629536d1d6a21
Opcode Fuzzy Hash: c2020dff14a11365077532462e163d058f742f9c9ff930a7caa389e43913f5e6
Instruction Fuzzy Hash: 98D0A9353853007AE228A330AC0BFCA2B109B40B10F6008257606AA0C0C8A068818B48

Function 00C82DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C82DC8
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C82DDB

Part of subcall function 00C5F292: Sleep.KERNEL32 ref: 00C5F30A

Strings

Shell_TrayWnd, xrefs: 00C82DC1

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5ccb5d6c489074b6d8c1404c84ddb7dddd3d0776d167a7ef6a5733728a50e465
Instruction ID: f41e1e830cf26d49874e26e37db79c0ae742fcf595399b947f956deee4a949b7
Opcode Fuzzy Hash: 5ccb5d6c489074b6d8c1404c84ddb7dddd3d0776d167a7ef6a5733728a50e465
Instruction Fuzzy Hash: 0FD02239398300B7E228B330AC0FFDB3B109F40B10F200835770AAA0C0C8E06881CB48

Function 00C2C17D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00C2C213
GetLastError.KERNEL32 ref: 00C2C221
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00C2C27C

Memory Dump Source

Source File: 0000000B.00000002.2362095251.0000000000BF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00BF0000, based on PE: true

Associated: 0000000B.00000002.2362074744.0000000000BF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000C8D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362156937.0000000000CB3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362211669.0000000000CBD000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.2362232550.0000000000CC5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_bf0000_Thus.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 16e1554040e7953c18b85a7ce936610f3fd59618d47a190b44fe31bf161e8f1e
Instruction ID: 8901df47e0f1d46326a438052977cc2e76f618554f1509ae84c023098a242181
Opcode Fuzzy Hash: 16e1554040e7953c18b85a7ce936610f3fd59618d47a190b44fe31bf161e8f1e
Instruction Fuzzy Hash: C4411930600225EFDB218FE5E8C4BBE7BA5EF12720F244169F865975A1DF308E01D760

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ModelsPreservation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\306780\Thus.com

C:\Users\user\AppData\Local\Temp\306780\g

C:\Users\user\AppData\Local\Temp\Adam

C:\Users\user\AppData\Local\Temp\Apartments

C:\Users\user\AppData\Local\Temp\Broken

C:\Users\user\AppData\Local\Temp\Cashiers

C:\Users\user\AppData\Local\Temp\Cheese

C:\Users\user\AppData\Local\Temp\Exact

C:\Users\user\AppData\Local\Temp\Expert

C:\Users\user\AppData\Local\Temp\Lie

C:\Users\user\AppData\Local\Temp\Mighty

C:\Users\user\AppData\Local\Temp\Nhs

C:\Users\user\AppData\Local\Temp\Opposed

C:\Users\user\AppData\Local\Temp\Pee

Windows Analysis Report
ModelsPreservation.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre