Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PR.exe

Overview

General Information

Sample Name:	PR.exe
Analysis ID:	723837
MD5:	4d32fa0ee0e0bf3e02f9c951b62f10d1
SHA1:	55924e7ed2192b0d6cadfa327bf9271833a18f53
SHA256:	31c5cfa7a0f0a0632b3c4b9edec97c1644d992fc6b16a7e772d09ad8f73c3c70
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Hides threads from debuggers

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Searches for specific processes (likely to inject)

Machine Learning detection for sample

Uses 32bit PE files

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

PE file contains sections with non-standard names

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

×

Process Tree

System is w10x64

PR.exe (PID: 6128 cmdline: C:\Users\user\Desktop\PR.exe MD5: 4D32FA0EE0E0BF3E02F9C951B62F10D1)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PR.exe	ReversingLabs: Detection: 46%
Source: PR.exe	Virustotal: Detection: 44%			Perma Link
Source: PR.exe	Metadefender: Detection: 24%			Perma Link

Machine Learning detection for sample

Source: PR.exe

Joe Sandbox ML: detected

Source: PR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PR.exe

Static PE information: certificate valid

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_004012DE FindFirstFileW,FindNextFileW,RemoveDirectoryW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,

Source: PR.exe	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: PR.exe, 00000000.00000002.501649671.000000001025D000.00000004.00000001.01000000.00000004.sdmp, htmlayout.dll.0.dr	String found in binary or memory: http://crl.nmsu.edu/~mleisher/ucdata.html)
Source: PR.exe	String found in binary or memory: http://express-files.com/uninstall/?sid=%s&aid=%s&d=%lld&s=%u
Source: PR.exe	String found in binary or memory: http://express-files.com/welcome/?sid=%s&aid=%s&b=%d&d=%lld
Source: PR.exe	String found in binary or memory: http://express-files.com/welcome/?sid=%s&aid=%s&b=%d&d=%lldExpressFilesExpressFilesDLerror%sExpressD
Source: PR.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: PR.exe, 00000000.00000003.243147116.0000000002BAB000.00000004.00000800.00020000.00000000.sdmp, PR.exe, 00000000.00000002.499575324.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, PR.exe, 00000000.00000002.501548684.0000000010223000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://terrainformatica.com/forums/topic.php?id=1772
Source: PR.exe, 00000000.00000002.501649671.000000001025D000.00000004.00000001.01000000.00000004.sdmp, htmlayout.dll.0.dr	String found in binary or memory: http://terrainformatica.comD
Source: PR.exe	String found in binary or memory: http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eula
Source: PR.exe	String found in binary or memory: http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eulalegal_terms2checkbox_install_too
Source: PR.exe	String found in binary or memory: http://www.babylon.com/toolbar
Source: PR.exe, 00000000.00000002.499417994.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.babylon.com/toolbar0
Source: PR.exe	String found in binary or memory: http://www.express-files.com/
Source: PR.exe	String found in binary or memory: http://www.express-files.com/PublisherInstallLocationhttp://www.express-files.com/URLInfoAbout1.2.0D
Source: PR.exe	String found in binary or memory: http://www.express-files.com/X

Source: PR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PR.exe, 00000000.00000002.501649671.000000001025D000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameHTMLayout.dll4 vs PR.exe
Source: PR.exe, 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameExpressFilesInstaller.exeP vs PR.exe
Source: PR.exe	Binary or memory string: OriginalFilenameExpressFilesInstaller.exeP vs PR.exe

Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00404620		0_2_00404620
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042E0BF		0_2_0042E0BF
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_004BD30F		0_2_004BD30F
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_004063B0		0_2_004063B0
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00430904		0_2_00430904
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00406AA0		0_2_00406AA0
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00405C10		0_2_00405C10
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00427D70		0_2_00427D70
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00404EED		0_2_00404EED

Source: C:\Users\user\Desktop\PR.exe	Memory allocated: 77A20000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory allocated: 74AA0000 page execute and read and write			Jump to behavior

Source: PR.exe	ReversingLabs: Detection: 46%
Source: PR.exe	Virustotal: Detection: 44%
Source: PR.exe	Metadefender: Detection: 24%

Source: C:\Users\user\Desktop\PR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00401000 CreateToolhelp32Snapshot,Process32FirstW,PathFindFileNameW,StrCmpIW,Process32NextW,CloseHandle,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_004018BE LockResource,SizeofResource,CreateFileW,VirtualFree,FreeResource,

Source: C:\Users\user\Desktop\PR.exe	Command line argument: uninstall.exe		0_2_00403344
Source: C:\Users\user\Desktop\PR.exe	Command line argument: _downloader		0_2_00403344
Source: C:\Users\user\Desktop\PR.exe	Command line argument: _downloader		0_2_00403344
Source: C:\Users\user\Desktop\PR.exe	Command line argument: _downloader		0_2_00403344

Source: C:\Users\user\Desktop\PR.exe

File created: C:\Users\user\AppData\Local\Temp\htmlayout.dll

Jump to behavior

Source: PR.exe	String found in binary or memory: ED-INSTALL
Source: PR.exe	String found in binary or memory: 0@_downloadertoolbar%u.exeBABYLON/mhp /mnt /mds /babTrack="affID=%s" /s /aflt=babsst /instlref=sst /srcExt=ssnext_pageprev_pageskip_pageside_page_%dinstall_foldersearch_keywordExpressFilesPipeExpressFilesPipeKeywordSoftware\ExpressFilesSoftware\ExpressFilesinstalllegal_termshttp://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eulalegal_terms2checkbox_install_toolbaruninstall%u.tmpExpressFiles%u.tmpexpressdl%u.tmphtmlayout%u.tmpdht%u.tmpexpressdl_startshttp://express-files.com/uninstall/?sid=%s&aid=%s&d=%lld&s=%uidED-UNINSTALLED-INSTALL
Source: PR.exe	String found in binary or memory: ED-INSTALL
Source: PR.exe	String found in binary or memory: <link rel="shortcut icon" href="./icons/ed-install.ico">
Source: PR.exe	String found in binary or memory: 3http://crl.usertrust.com/AddTrustExternalCARoot.crl05

Source: classification engine

Classification label: mal64.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00401A2A CoCreateInstance,

Source: PR.exe

Static file information: File size 4721272 > 1048576

Source: PR.exe

Static PE information: certificate valid

Source: PR.exe

Static PE information: Raw size of .p0 is bigger than: 0x100000 < 0x419600

Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_008284D5 push dword ptr [esp+24h]; retn 0028h		0_2_004B68C0
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_008284D5 push eax; mov dword ptr [esp], 00000000h		0_2_0082852A
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0082BB4F push dword ptr [esp+2Ch]; retn 0034h		0_2_0073BFBB
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00833080 push dword ptr [esp+2Ch]; retn 0030h		0_2_0083309E
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00635069 push dword ptr [esp+24h]; retn 0030h		0_2_0063509E
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00635069 push dword ptr [esp]; mov dword ptr [esp], ecx		0_2_00832925
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00635069 push dword ptr [esp+08h]; retn 0014h		0_2_00832930
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00422056 push dword ptr [esp+28h]; retn 002Ch		0_2_0073E03C
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00429056 push dword ptr [esp+28h]; retn 003Ch		0_2_00639E60
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00431055 pushad ; retf		0_2_0043106A
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042405B pushfd ; mov dword ptr [esp], edi		0_2_00424066
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042405B push dword ptr [esp+2Ch]; retn 0030h		0_2_00424090
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042405B push ebx; mov dword ptr [esp], 114D6820h		0_2_0083120C
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00420058 push dword ptr [esp+50h]; retn 0054h		0_2_0042168E
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042905C push dword ptr [esp+0Ch]; retn 0010h		0_2_004290BC
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042006B push dword ptr [esp+50h]; retn 0054h		0_2_0042168E
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0073C05F push dword ptr [esp+4Ch]; retn 0050h		0_2_0073C081
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0043106D push edx; retf		0_2_0043106E
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_008330B4 push dword ptr [esp+3Ch]; retn 0040h		0_2_008330D7
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0043107D push 47B074CBh; retf		0_2_00431082
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042207D push dword ptr [esp+10h]; retn 0014h		0_2_004220E5
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042207D push dword ptr [esp+04h]; retn 000Ch		0_2_00833C7C
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0041F000 pushad ; mov dword ptr [esp], edi		0_2_0042027D
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00424000 push dword ptr [esp+4Ch]; retn 0050h		0_2_00641690
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_004B600C pushfd ; mov dword ptr [esp], esi		0_2_00828115
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_004AE01B pushfd ; mov dword ptr [esp], 1D616640h		0_2_006331DF
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0064A031 push dword ptr [esp+20h]; retn 0024h		0_2_008282AD
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00429015 push dword ptr [esp+34h]; retn 0038h		0_2_00831E2B
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00420019 push dword ptr [esp+50h]; retn 0054h		0_2_0042168E
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0064A03F push dword ptr [esp+20h]; retn 0024h		0_2_008282AD
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0043102C pushad ; retf		0_2_0043102D

Source: PR.exe	Static PE information: section name: .p0
Source: PR.exe	Static PE information: section name: .p1

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_0042EACC LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

Source: initial sample

Static PE information: section where entry point is pointing to: .p1

Source: initial sample

Static PE information: section name: .p1 entropy: 7.632325075524795

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\PR.exe

File created: C:\Users\user\AppData\Local\Temp\htmlayout.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 77A20005 value: E9 FB BF E9 FF			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 778BC000 value: E9 FB 80 B6 88			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 77A20017 value: E9 9C E0 ED FF			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 778FE0B0 value: E9 DB 60 B2 88			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 74AA0005 value: E9 CB 5A E6 FF			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 74905AD0 value: E9 3B E5 B1 8B			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 74AA0014 value: E9 4C B0 E8 FF			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Memory written: PID: 6128 base: 7492B060 value: E9 3B 90 AF 8B			Jump to behavior

Source: C:\Users\user\Desktop\PR.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00740025 rdtsc

Source: C:\Users\user\Desktop\PR.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PR.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_004012DE FindFirstFileW,FindNextFileW,RemoveDirectoryW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,

Source: C:\Users\user\Desktop\PR.exe	API call chain: ExitProcess graph end node			graph_0-25485
Source: C:\Users\user\Desktop\PR.exe	API call chain: ExitProcess graph end node			graph_0-25158

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\PR.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_0040707A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\Desktop\PR.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PR.exe	Process queried: DebugObjectHandle			Jump to behavior

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_0042EACC LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_004014D8 OpenProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,SetLastError,GetLastError,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,CloseHandle,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00740025 rdtsc

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00424944 LdrFindResource_U,

Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0040D057 SetUnhandledExceptionFilter,		0_2_0040D057
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0040707A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0040707A
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042B08C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0042B08C
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_00409537 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00409537
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042E826 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0042E826
Source: C:\Users\user\Desktop\PR.exe	Code function: 0_2_0042AEE9 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0042AEE9

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00401000 CreateToolhelp32Snapshot,Process32FirstW,PathFindFileNameW,StrCmpIW,Process32NextW,CloseHandle,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00402025 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,MessageBoxW,

Source: C:\Users\user\Desktop\PR.exe

Code function: GetLocaleInfoA,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00409A25 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00402B22 SHGetValueA,__time64,__localtime64_s,SHSetValueA,GetVersionExW,CoCreateGuid,UuidToStringW,__snwprintf,RpcStringFreeW,SHSetValueW,

Source: C:\Users\user\Desktop\PR.exe

Code function: 0_2_00407846 GetSystemTimeAsFileTime,__aulldiv,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Command and Scripting Interpreter	Path Interception	1 Process Injection	11 Virtualization/Sandbox Evasion	1 Credential API Hooking	2 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	14 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Software Packing	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PR.exe	46%	ReversingLabs	Win32.PUA.ExpressDownloader
PR.exe	44%	Virustotal		Browse
PR.exe	24%	Metadefender		Browse
PR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\htmlayout.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\htmlayout.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\htmlayout.dll	5%	Metadefender		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.PR.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://terrainformatica.com/forums/topic.php?id=1772	1%	Virustotal		Browse
http://terrainformatica.com/forums/topic.php?id=1772	0%	Avira URL Cloud	safe
http://terrainformatica.comD	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eula	PR.exe	false		high
http://www.babylon.com/redirects/redir.cgi?type=babylon_toolbar_eulalegal_terms2checkbox_install_too	PR.exe	false		high
http://www.babylon.com/toolbar0	PR.exe, 00000000.00000002.499417994.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.babylon.com/toolbar	PR.exe	false		high
http://terrainformatica.com/forums/topic.php?id=1772	PR.exe, 00000000.00000003.243147116.0000000002BAB000.00000004.00000800.00020000.00000000.sdmp, PR.exe, 00000000.00000002.499575324.0000000002BC0000.00000004.00000800.00020000.00000000.sdmp, PR.exe, 00000000.00000002.501548684.0000000010223000.00000040.00000001.01000000.00000004.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://terrainformatica.comD	PR.exe, 00000000.00000002.501649671.000000001025D000.00000004.00000001.01000000.00000004.sdmp, htmlayout.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://crl.nmsu.edu/~mleisher/ucdata.html)	PR.exe, 00000000.00000002.501649671.000000001025D000.00000004.00000001.01000000.00000004.sdmp, htmlayout.dll.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	723837
Start date and time:	2022-10-15 19:00:33 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PR.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 84% Number of executed functions: 25 Number of non-executed functions: 48
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\htmlayout.dll	study_guide_with_answers_for_fresh_water_certifications_california_downloader_2505b.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\htmlayout.dll

Process:	C:\Users\user\Desktop\PR.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	936960
Entropy (8bit):	7.924513528423757
Encrypted:	false
SSDEEP:	12288:b3nqQ3krBXVXoxwXjND3iZ8baxfSelRmMimfwoCFSkylHu8DL6y47KYuLB3KikSQ:bM91XjQikAmf/T1Huc747KhgtSTEyY
MD5:	A55B82103A202C20717F45C201EC4553
SHA1:	C6607F6201793A20131281F3C5F612F38AE024D5
SHA-256:	C7EAAE39F8DAF00F43FEE614EF0FC4A4797252C409AF1A5E36AF439E7165FC05
SHA-512:	993891C388570612D1A6834489FCB80A32AB23A3E59859C0BFD9B60903CE240ACE1058E0F062F3C8A415505F85EF28D29D1C6DF7477E30A2BBB2D7F66F455F65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2% Antivirus: Virustotal, Detection: 1%, Browse Antivirus: Metadefender, Detection: 5%, Browse
Joe Sandbox View:	Filename: study_guide_with_answers_for_fresh_water_certifications_california_downloader_2505b.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ip.5-.yf-.yf-.yf...f..yf...f..yf...fi.yf...f..yf..&f(.yf..$f0.yf-.xfI.yf...f..yf...f,.yf...f,.yf...f,.yfRich-.yf................PE..L......N...........!..... ...0........%.......%...............................&.......................................%.(.....%.8.....%.......................%.......................................%.H...........................................UPX0....................................UPX1..... ..........................@....rsrc....0....%.....................@..............................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.885963019060166
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PR.exe
File size:	4721272
MD5:	4d32fa0ee0e0bf3e02f9c951b62f10d1
SHA1:	55924e7ed2192b0d6cadfa327bf9271833a18f53
SHA256:	31c5cfa7a0f0a0632b3c4b9edec97c1644d992fc6b16a7e772d09ad8f73c3c70
SHA512:	274ef06aee2958556af786613568378f2567a77521b3367cec58567132f362f05a0cde474fc769983e3be9b1a36ffa0889f1fc6582d07abdde696fb15296db2a
SSDEEP:	98304:fY9Aw2AWi+v+iPP2sq3pfe+amFFMj1INPtm:97vvP2sq31eDmy1gPQ
TLSH:	6C2623927275C032C0430E7DE861C0FDAD78AC54EB7088C776D83E6B76F26956A3A356
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(.r.l...l...l.......m...w...Y.......o...e...o...e...}...l.......w...y...w.......w...c...w...m...w...m...Richl..................

File Icon


Icon Hash:	2d0c2f8b0e0d1307

Static PE Info

General

Entrypoint:	0x84554f
Entrypoint Section:	.p1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4EF9E421 [Tue Dec 27 15:28:33 2011 UTC]
TLS Callbacks:	0x83b609
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	8a72f9325ccba2e6d83699ae4ce47f63

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	12/15/2011 4:00:00 PM 12/15/2012 3:59:59 PM
Subject Chain	CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET="Konstantinoupoleos, 22", L=Nicosia, S=Aglantzia/Cyprus, PostalCode=2107, C=CY
Version:	3
Thumbprint MD5:	65650DB9F1757E4030C150B4C95BCE6D
Thumbprint SHA-1:	D76FF3FA2EB22BF49CB793A7BCB814CC54ADDB16
Thumbprint SHA-256:	3201389CCD8D95CB2C9CAFF84FB21957393031D240BEF84023ED4220B5264522
Serial:	00DD2A4BBB66262A8FB4E084560573E908

Entrypoint Preview

Instruction
push A03511A6h
pushfd
push dword ptr [esp+04h]
mov byte ptr [esp], al
mov dword ptr [esp+08h], 12043840h
jmp 00007F5A50DF77C9h
add byte ptr [eax], al
inc esp
jne 00007F5A50DFB7D2h
insb
imul esp, dword ptr [ebx+61h], 6F546574h
imul esp, dword ptr [ebp+6Eh], 45h
js 00007F5A50DFB762h
cmc
jmp 00007F5A50DF6856h
clc
push dword ptr [edi]
pop dword ptr [esp+0Ch]
cmp dl, FFFFFFD9h
clc
cmp edi, ebx
mov byte ptr [esp+08h], 00000074h
pushad
mov byte ptr [esp], FFFFFFB7h
pushfd
lea esp, dword ptr [esp+30h]
ja 00007F5A50DF334Ch
clc
call 00007F5A50DFC12Eh
inc esi
pushad
inc edi
mov byte ptr [esp+08h], cl
lea esp, dword ptr [esp+24h]
jmp 00007F5A50DF7FDDh
add byte ptr [eax], al
push ebp
outsb
push 6C646E61h
inc ebp
js 00007F5A50DFB7C5h
jo 00007F5A50DFB7D7h
imul ebp, dword ptr [edi+6Eh], 746C6946h
jc 00007F5A50DFB763h
mov dword ptr [esp+24h], 0083A459h
push 5B4C937Bh
push edi
jmp 00007F5A50DF0778h
out dx, eax
jno 00007F5A50DFB7DDh
add dword ptr [ecx], edi
push ds
mov ds, word ptr [eax]
xchg esp, eax
cmp dl, byte ptr [ebx+ebp*8-0D0B5DD0h]
test byte ptr [edx], dl
xchg eax, esp
xlatb
fsubr qword ptr [esi+08h]
aas
push esp
mov ebx, BEB87608h
pushad
scasb
nop
fcom dword ptr [edi-59F54D6Eh]
or ebp, dword ptr [ebp-51h]

Rich Headers

Programming Language:

[C++] VS2010 SP1 build 40219
[C++] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x437922	0xc50	.p0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x43b4ac	0x104	.p1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44a000	0x3b6c1	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x47f000	0x1a78	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x43cc68	0x20	.p1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x43ddd4	0x420	.p1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11c2b	0x11e00	False	0.5970962631118881	data	6.598860248501709	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x77c0	0x7800	False	0.5557942708333333	data	6.160344874513789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x3084	0x1200	False	0.2133246527777778	data	2.5802933454414196	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.p0	0x1f000	0x419572	0x419600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x439000	0x18	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.p1	0x43a000	0xf2c8	0xf400	False	0.8702612704918032	data	7.632325075524795	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x44a000	0x3b6c1	0x3b800	False	0.0679695706407563	data	2.5785919717396517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x44a548	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088
RT_ICON	0x44a9b0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400
RT_ICON	0x44b338	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224
RT_ICON	0x44c3e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600
RT_ICON	0x44e988	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896
RT_ICON	0x452bb0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584
RT_ICON	0x4633d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088
RT_ICON	0x463840	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400
RT_ICON	0x4641c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224
RT_ICON	0x465270	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600
RT_ICON	0x467818	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896
RT_ICON	0x46ba40	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584
RT_GROUP_ICON	0x47c268	0x5a	data
RT_GROUP_ICON	0x47c2c4	0x5a	data
RT_VERSION	0x47c320	0x378	data
RT_HTML	0x47c698	0xa8a	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
RT_HTML	0x47d124	0x377c	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (1102), with CRLF line terminators
RT_HTML	0x4808a0	0x34bf	HTML document, Unicode text, UTF-8 (with BOM) text, with very long lines (1102), with CRLF line terminators
RT_HTML	0x483d60	0x967	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
RT_HTML	0x4846c8	0x767	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
RT_HTML	0x484e30	0x64b	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
RT_MANIFEST	0x48547c	0x245	ASCII text, with very long lines (364), with CRLF line terminators	English	United States

Imports

DLL	Import
RPCRT4.dll	UuidToStringW, RpcStringFreeW
SHLWAPI.dll	SHSetValueW, PathFindFileNameW, SHGetValueA, SHSetValueA, SHGetValueW, SHDeleteValueW, SHDeleteKeyW, StrCmpIW, PathRemoveExtensionW
USER32.dll	CreateWindowExW, GetMessageW, DispatchMessageW, GetWindowRect, PostQuitMessage, DefWindowProcW, ShowWindow, MessageBoxW, GetWindowThreadProcessId, GetShellWindow, LoadIconW, RegisterClassExW, LoadCursorW, GetSystemMetrics, TranslateMessage
KERNEL32.dll	GetStringTypeW, GetConsoleMode, GetConsoleCP, QueryPerformanceCounter, HeapCreate, GetFileType, InitializeCriticalSectionAndSpinCount, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetModuleFileNameA, GetStdHandle, IsProcessorFeaturePresent, ExitProcess, HeapSize, Sleep, LCMapStringW, TlsFree, TlsSetValue, TlsGetValue, GetFileSize, FindFirstFileW, SetFilePointer, VirtualQuery, VirtualFree, WriteFile, OpenProcess, WideCharToMultiByte, TerminateProcess, ReadFile, CreateFileW, MultiByteToWideChar, GetLastError, FindClose, Process32FirstW, RemoveDirectoryW, Process32NextW, FindNextFileW, CreateToolhelp32Snapshot, CloseHandle, DeleteFileW, GetCurrentProcessId, CreateProcessW, HeapAlloc, HeapFree, GetProcessHeap, SetLastError, GetProcAddress, GetModuleHandleA, FindResourceA, FreeResource, LoadResource, LoadLibraryW, SizeofResource, GetTempPathW, LockResource, CreateMutexW, CreateDirectoryW, CopyFileW, GetModuleFileNameW, FindResourceW, GetVersionExW, InitializeCriticalSection, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, GetTickCount, MapViewOfFile, SetEvent, SetEnvironmentVariableA, OpenFileMappingA, MoveFileExW, GetModuleHandleW, GetCurrentThreadId, RtlUnwind, HeapReAlloc, SetStdHandle, WriteConsoleW, FlushFileBuffers, CompareStringW, VirtualAlloc, OpenEventA, TlsAlloc, IsValidCodePage, GetOEMCP, GetACP, InterlockedDecrement, InterlockedIncrement, GetCPInfo, GetTimeZoneInformation, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, GetStartupInfoW, HeapSetInformation, GetCommandLineA, LocalAlloc, FreeLibrary, InterlockedExchange, LoadLibraryA, RaiseException, GetSystemTimeAsFileTime, EncodePointer, DecodePointer
ADVAPI32.dll	SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetSecurityDescriptorGroup, DuplicateTokenEx, GetTokenInformation, GetSidSubAuthorityCount, GetSidSubAuthority, OpenProcessToken, SetSecurityDescriptorSacl
SHELL32.dll	SHGetSpecialFolderPathW, SHChangeNotify, ShellExecuteW
ole32.dll	CoCreateInstance, CoInitialize, CoCreateGuid, CoUninitialize
OLEAUT32.dll	SysFreeString, SysAllocString
KERNEL32.dll	InitializeCriticalSection, GetModuleFileNameW, GetModuleHandleW, TerminateProcess, GetCurrentProcess, DeleteCriticalSection, LoadLibraryW, CreateEventW, CompareStringW, SetLastError, GetModuleHandleA, VirtualProtect, GetTickCount, EnterCriticalSection, LeaveCriticalSection, VirtualFree, VirtualAlloc, WriteProcessMemory, CreateToolhelp32Snapshot, GetCurrentProcessId, GetCurrentThreadId, Thread32First, OpenThread, Thread32Next, CloseHandle, SuspendThread, ResumeThread, GetSystemInfo, FreeLibrary, LoadResource, MultiByteToWideChar, WideCharToMultiByte, FindResourceExW, FindResourceExA, GetThreadLocale, GetUserDefaultLCID, GetSystemDefaultLCID, EnumResourceNamesA, EnumResourceNamesW, EnumResourceLanguagesA, EnumResourceLanguagesW, EnumResourceTypesA, EnumResourceTypesW, HeapAlloc, HeapFree, HeapDestroy, HeapCreate, GetSystemTime, GetLocalTime, SystemTimeToFileTime, CompareFileTime, GetCommandLineA, GetLastError, RaiseException, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, WriteFile, GetStdHandle, GetModuleFileNameA, GetProcAddress, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, InterlockedDecrement, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, Sleep, ExitProcess, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetSystemTimeAsFileTime, HeapReAlloc, HeapSize, LoadLibraryA, GetLocaleInfoA, RtlUnwind, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, InitializeCriticalSectionAndSpinCount, VirtualQuery
USER32.dll	MessageBoxW, CharUpperBuffW, wsprintfW
KERNEL32.dll	GetModuleFileNameW
KERNEL32.dll	GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: PR.exePID: 6128, Parent PID: 3452

General

Target ID:	0
Start time:	19:01:20
Start date:	15/10/2022
Path:	C:\Users\user\Desktop\PR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PR.exe
Imagebase:	0x400000
File size:	4721272 bytes
MD5 hash:	4D32FA0EE0E0BF3E02F9C951B62F10D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: PR.exePID: 6128, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	662
Total number of Limit Nodes:	35

Executed Functions

Function 00403344 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040337B
_memset.LIBCMT ref: 00403392
_memset.LIBCMT ref: 004033A9
CoInitialize.OLE32(00000000), ref: 004033B2
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004033C5
PathFindFileNameW.SHLWAPI(?), ref: 004033DB
PathRemoveExtensionW.SHLWAPI(?,?), ref: 0040343D
GetMessageW.USER32(?,00000005,?), ref: 004034C9
TranslateMessage.USER32(?), ref: 004034EA
DispatchMessageW.USER32 ref: 004034F7
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00403507
CoUninitialize.OLE32 ref: 0040350E

Strings

uninstall.exe, xrefs: 004033E3
_downloader, xrefs: 00403424, 00403429, 00403449

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Message_memset$FileNamePath$CallbackDispatchDispatcherExtensionFindInitializeModuleRemoveTranslateUninitializeUser
String ID: _downloader$uninstall.exe
API String ID: 1925323219-1242169958
Opcode ID: c324590a0ce745eda1344a380bc435acc89318a2be9a551ed4d93f5a503d84b7
Instruction ID: 4c72e9e54b9c5b156c6e465c00aec75b6206f9886f539bb8ff1e4c5f3ecefcbb
Opcode Fuzzy Hash: c324590a0ce745eda1344a380bc435acc89318a2be9a551ed4d93f5a503d84b7
Instruction Fuzzy Hash: E951D8B29002186BDB20AFB49C49DEB7BBDAF04305F0044BBE505E7191E639DF84CB19

Uniqueness

Uniqueness Score: -1.00%

Function 004018BE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LockResource.KERNEL32(00000000), ref: 004018F4
SizeofResource.KERNEL32(00000000,00000000), ref: 00401903

Part of subcall function 00401738: VirtualQuery.KERNEL32(?,?,0000001C), ref: 004017EA
Part of subcall function 00401738: VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 0040180C
Part of subcall function 00401738: VirtualQuery.KERNEL32(00000000,?,0000001C), ref: 0040181C
Part of subcall function 00401738: _memmove.LIBCMT ref: 00401839
Part of subcall function 00401738: VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0040184B
Part of subcall function 00401738: _memmove.LIBCMT ref: 0040187E

CreateFileW.KERNEL32(?,C0000000,00000001,?,00000004,00000000,00000000), ref: 0040192E
VirtualFree.KERNELBASE(?,00000000,00000000,00008000), ref: 00401957

Part of subcall function 004010C3: SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 004010D0
Part of subcall function 004010C3: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004010E4
Part of subcall function 004010C3: FindCloseChangeNotification.KERNEL32(?), ref: 004010F2

FreeResource.KERNEL32(?), ref: 00401960

Strings

DATA, xrefs: 004018C7

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Virtual$FileFreeResource$Query_memmove$AllocChangeCloseCreateFindLockNotificationPointerSizeofWrite
String ID: DATA
API String ID: 3338994381-2607161047
Opcode ID: 43634e365bc6304ab77662dd5d6e79e39689ae69be95f1e161d3ea62de2dfd7f
Instruction ID: b6a72d859ebda8869b5ec73df7a6c5c7c88b4df4c73b1f2fdcee4555530aa3c9
Opcode Fuzzy Hash: 43634e365bc6304ab77662dd5d6e79e39689ae69be95f1e161d3ea62de2dfd7f
Instruction Fuzzy Hash: 9411C1B29001547FCB202FB09C89EEF7FACEB093A5F148176F602B21A0D6354E05CA68

Uniqueness

Uniqueness Score: -1.00%

Function 00404620 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 664COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00404A6E

Strings

$=A, xrefs: 00404831

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: _memmove
String ID: $=A
API String ID: 4104443479-2872446614
Opcode ID: 40503abbdc25397d16d02e79969c2ce682e5507a5d6ef3e192dadf46dc2f7650
Instruction ID: 958b532b45518b410c63ed0a0fa3cb7b791211a8b1247b0f4ebe38763940f10d
Opcode Fuzzy Hash: 40503abbdc25397d16d02e79969c2ce682e5507a5d6ef3e192dadf46dc2f7650
Instruction Fuzzy Hash: 31425DB0A00606EFDB18CFA9C4947AAB7B1FF84314F14826ED91567781D379A991CFC8

Uniqueness

Uniqueness Score: -1.00%

Function 00404EED Relevance: 2.1, Strings: 1, Instructions: 811COMMON

Download Yara Rule

Strings

,<A, xrefs: 00405289

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID: ,<A
API String ID: 0-3158208111
Opcode ID: 5fb24749b243ac1bb5544f10881352a6255c9b45cb4883c4c2a4926d12b19fdb
Instruction ID: 6749fb4c82892b048401d6f7300d245d6c794ae251d6cbf270c4ca08fd9c1e47
Opcode Fuzzy Hash: 5fb24749b243ac1bb5544f10881352a6255c9b45cb4883c4c2a4926d12b19fdb
Instruction Fuzzy Hash: 41629BB0E00A16DBCB08CF55C4906EEBBB2FF84311F14826EC8566BB84D778A955DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00403FBE Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 103
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconW.USER32(?,ED-UNINSTALL), ref: 00404009
LoadCursorW.USER32 ref: 0040403E
LoadIconW.USER32(00007F00,00007F00), ref: 00404061
RegisterClassExW.USER32 ref: 0040406E
GetSystemMetrics.USER32 ref: 00404085
GetCurrentProcessId.KERNEL32 ref: 00404096
GetSystemMetrics.USER32 ref: 004040A6
GetTickCount.KERNEL32 ref: 004040B7
CreateWindowExW.USER32 ref: 004040DD
ShowWindow.USER32(00000000,00000000), ref: 004040EF
HTMLayoutSetCallback.HTMLAYOUT(?,00404253,?), ref: 00404101
HTMLayoutWindowAttachEventHandler.HTMLAYOUT(?,Function_000026FA,?,0000FFFF), ref: 00404118

Strings

0, xrefs: 0040401A
ED-UNINSTALL, xrefs: 00403FF8
ED-INSTALL, xrefs: 00404002, 00404007
Express Files Installer, xrefs: 0040404C, 004040DA, 004040DB

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: LoadWindow$IconLayoutMetricsSystem$AttachCallbackClassCountCreateCurrentCursorEventHandlerProcessRegisterShowTick
String ID: 0$ED-INSTALL$ED-UNINSTALL$Express Files Installer
API String ID: 210944194-3508738347
Opcode ID: 06d340f8641b789c9a5e5abd886eba0797611e60d313e248d42d0477f59ae928
Instruction ID: b7c46b048ad1924dbec244454a61321318e935f4e6c9be6193158c84f22ab041
Opcode Fuzzy Hash: 06d340f8641b789c9a5e5abd886eba0797611e60d313e248d42d0477f59ae928
Instruction Fuzzy Hash: 51414EB1940309AFCB109FA5ED88ADABFF9FF48305F10852EF555A6290C7789A50CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D70 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00402D77

Part of subcall function 00403FBE: LoadIconW.USER32(?,ED-UNINSTALL), ref: 00404009
Part of subcall function 00403FBE: LoadCursorW.USER32 ref: 0040403E
Part of subcall function 00403FBE: LoadIconW.USER32(00007F00,00007F00), ref: 00404061
Part of subcall function 00403FBE: RegisterClassExW.USER32 ref: 0040406E

__snwprintf.LIBCMT ref: 00402DFD
_memset.LIBCMT ref: 00402E63
_memset.LIBCMT ref: 00402E89
__snwprintf.LIBCMT ref: 00402EB3
__snwprintf.LIBCMT ref: 00402EC6
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000001), ref: 00402EF9
_memset.LIBCMT ref: 00402F31

Strings

0.2, xrefs: 00402E95
install_dir, xrefs: 00402EDC
\ExpressFiles, xrefs: 00402F1B
magnets://&dn=%s, xrefs: 00402DF0
000, xrefs: 00402EA0
109130, xrefs: 00402EB8

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Load__snwprintf_memset$Icon$ClassCursorFolderH_prolog3PathRegisterSpecial
String ID: 0.2$000$109130$\ExpressFiles$install_dir$magnets://&dn=%s
API String ID: 185405883-2498389280
Opcode ID: 79e3d5576d4aaa686428d6ada03952e0f5d0565c25d4f907fa76fc17c96a4213
Instruction ID: ea2785b9a7cfe83e38df8a92285021a84428914f4ddce35af8cdc146302160d4
Opcode Fuzzy Hash: 79e3d5576d4aaa686428d6ada03952e0f5d0565c25d4f907fa76fc17c96a4213
Instruction Fuzzy Hash: 8051F572940201AADF109F25DD8ABD73BA4AF15344F08447EBC08AF2C3DBB89A44C769

Uniqueness

Uniqueness Score: -1.00%

Function 00403784 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 196
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0040382D
__snwprintf.LIBCMT ref: 00403909

Strings

search_keyword, xrefs: 00403977
m@, xrefs: 00403936
prev_page, xrefs: 004038CD
skip_page, xrefs: 004038DF
next_page, xrefs: 004038BB
side_page_%d, xrefs: 004038F8
install_folder, xrefs: 0040392A

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: MessagePostQuit__snwprintf
String ID: install_folder$next_page$prev_page$search_keyword$side_page_%d$skip_page$m@
API String ID: 332545653-1195871625
Opcode ID: 2d3211c976f39a1ad3cae1e698c64a211162ba75ea046345c91a74a11c8fd23e
Instruction ID: 0742a25780819667d97fd00682e1908afe3abac025f018701c19e54c2fcfc051
Opcode Fuzzy Hash: 2d3211c976f39a1ad3cae1e698c64a211162ba75ea046345c91a74a11c8fd23e
Instruction Fuzzy Hash: D171A3B2B001456BC719EF64CC85BEABB9CBB44309F0445BBE515B72C2D7B8AB518B84

Uniqueness

Uniqueness Score: -1.00%

Function 00401738 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 004017EA
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 0040180C
VirtualQuery.KERNEL32(00000000,?,0000001C), ref: 0040181C
_memmove.LIBCMT ref: 00401839
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0040184B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00401867
_memmove.LIBCMT ref: 0040187E

Strings

1.2.5, xrefs: 00401768

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Virtual$AllocQuery_memmove$Free
String ID: 1.2.5
API String ID: 4294742970-1624589015
Opcode ID: 31501027feff36da652c365caaae3264d79ff67f4ca3a71e9f11514a9d4cf7f2
Instruction ID: 86625964a9214b745db249fa7d2cbd1e1e24644384fedf20ee64b46e1609f527
Opcode Fuzzy Hash: 31501027feff36da652c365caaae3264d79ff67f4ca3a71e9f11514a9d4cf7f2
Instruction Fuzzy Hash: 56412DB2908300AFD311DF55D841A5FBBE8FBC8754F10492EF694E2290D774EA45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004011C3 Relevance: 13.6, APIs: 9, Instructions: 67
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004011DD
GetFileSize.KERNEL32(00000000,00000000), ref: 004011EC
VirtualAlloc.KERNEL32(00000000,00000001,00003000,00000040), ref: 00401203
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401219
GetLastError.KERNEL32 ref: 00401231
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0040123E
GetLastError.KERNEL32 ref: 00401248
CloseHandle.KERNEL32(00000000), ref: 0040124F
GetLastError.KERNEL32 ref: 00401257

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ErrorFileLast$Virtual$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 1146571148-0
Opcode ID: 37dd9eed26a83323c2a284823be1f5f25ad69bc7794b18f68c4e50ebe19554da
Instruction ID: c12a782f906d818db8c3dc3d81b72a54dfbdf4662c09b18b9902188595212558
Opcode Fuzzy Hash: 37dd9eed26a83323c2a284823be1f5f25ad69bc7794b18f68c4e50ebe19554da
Instruction Fuzzy Hash: 3B115171201214BFD7215FA1AC4CEAF3EACEF4A762B114065FA0AF62A4C6748B41D669

Uniqueness

Uniqueness Score: -1.00%

Function 0040292D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFindFileNameW.SHLWAPI(?,00000104), ref: 00402964
_wcsrchr.LIBCMT ref: 00402980
__wcsicoll.LIBCMT ref: 0040299D
LockResource.KERNEL32(00000000), ref: 004029D2
SizeofResource.KERNEL32(00000000,00000000), ref: 004029E0

Strings

HTML, xrefs: 00402997

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Resource$FileFindLockNamePathSizeof__wcsicoll_wcsrchr
String ID: HTML
API String ID: 2245601013-787223889
Opcode ID: dda1e72e56ba5a56434a93195db2fa2a826fa0460f9a1286134031ebcd19e3a4
Instruction ID: d2d7791254bdd5dbebf1fad31e424753c879ce168d6b070590b9077a05e1630d
Opcode Fuzzy Hash: dda1e72e56ba5a56434a93195db2fa2a826fa0460f9a1286134031ebcd19e3a4
Instruction Fuzzy Hash: 42212CB1A00214ABCB209F25CD4D9EFB7BCAF05710F244576F415F32C0E6BC8D8196A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402FED Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00402FF4

Part of subcall function 0040292D: PathFindFileNameW.SHLWAPI(?,00000104), ref: 00402964
Part of subcall function 0040292D: _wcsrchr.LIBCMT ref: 00402980
Part of subcall function 0040292D: __wcsicoll.LIBCMT ref: 0040299D

HTMLayoutDataReady.HTMLAYOUT(?,?,?,?,?), ref: 00403098
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004030A6
HTMLayoutDataReady.HTMLAYOUT(?,?,?,?), ref: 004030C2

Strings

.css, xrefs: 00403026
.html, xrefs: 00403013

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: DataLayoutReady$FileFindFreeH_prolog3NamePathVirtual__wcsicoll_wcsrchr
String ID: .css$.html
API String ID: 3167611623-4083043085
Opcode ID: 432df8b93222d1f18cf9b40762c0fbb3e75d5c6c1ec1d04aa8d5ac892871735a
Instruction ID: b8d1d480978cf86a5870125b932f261cdf0a3e3d280eb0778ca8e60e29150886
Opcode Fuzzy Hash: 432df8b93222d1f18cf9b40762c0fbb3e75d5c6c1ec1d04aa8d5ac892871735a
Instruction Fuzzy Hash: 60216036900209AFCF11EF90CC41EDEBBB5AF08315F20847AE540771A1DB3AAE05DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00404167 Relevance: 9.1, APIs: 6, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040292D: PathFindFileNameW.SHLWAPI(?,00000104), ref: 00402964
Part of subcall function 0040292D: _wcsrchr.LIBCMT ref: 00402980
Part of subcall function 0040292D: __wcsicoll.LIBCMT ref: 0040299D

HTMLayoutLoadHtml.HTMLAYOUT(?,?,004038B3,-00000004,00000000,?,?,?,004038B3,?,?,?), ref: 0040418D
HTMLayoutGetRootElement.HTMLAYOUT(?,00000000), ref: 004041A4
HTMLayout_UseElement.HTMLAYOUT(00000000), ref: 004041B7
HTMLayout_UnuseElement.HTMLAYOUT(?), ref: 004041CD
HTMLayout_UseElement.HTMLAYOUT(?), ref: 004041DB
HTMLayout_UnuseElement.HTMLAYOUT(?), ref: 004041F0

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Element$Layout_$LayoutUnuse$FileFindHtmlLoadNamePathRoot__wcsicoll_wcsrchr
String ID:
API String ID: 592801526-0
Opcode ID: 23b2188b13e09366928207186a69aecbe308896f3c39084960b98da94681c3d7
Instruction ID: fbd6acc7b171e58c408a97e6f1990444d0adef6c4c254aca0c88bb36e11ae2c2
Opcode Fuzzy Hash: 23b2188b13e09366928207186a69aecbe308896f3c39084960b98da94681c3d7
Instruction Fuzzy Hash: 3511A07559021AFFCB01CFA4DC88ADEBBB8FF04355F108121F904E6151D734AA559BD8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C96 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000001), ref: 00402CC0
__snprintf.LIBCMT ref: 00402D22
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00402D55

Strings

%ws, xrefs: 00402D11
\Babylon\log_file.txt, xrefs: 00402CF5

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: FolderFreePathSpecialVirtual__snprintf
String ID: %ws$\Babylon\log_file.txt
API String ID: 1580690700-2964430317
Opcode ID: bdc2ffd35a787e7dff7cd27678a4c457d3113ba41b49fc49a99695fa0d7ae68e
Instruction ID: 701b53b33f1e6b625f5b8f7938b7a6b3f20370d80b49a7aed30468fb6318e0b4
Opcode Fuzzy Hash: bdc2ffd35a787e7dff7cd27678a4c457d3113ba41b49fc49a99695fa0d7ae68e
Instruction Fuzzy Hash: 22110A76E0021CABDB259B64DC46FDF73BCAB08714F0001AAF515B61C0DEB49FC48A98

Uniqueness

Uniqueness Score: -1.00%

Function 00402A05 Relevance: 7.6, APIs: 5, Instructions: 61
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00402A28
HTMLayoutProcND.HTMLAYOUT(?,?,?,?,?), ref: 00402A38
DefWindowProcW.USER32(?,?,?,?), ref: 00402A4A
DefWindowProcW.USER32(?,?,?,?), ref: 00402A6C
GetWindowRect.USER32 ref: 00402A83

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ProcWindow$LayoutMessagePostQuitRect
String ID:
API String ID: 1511509333-0
Opcode ID: 518305beab2af7f7448f46251e0551b1fe354645419727d614e3ae1f13e98812
Instruction ID: 90a3f11a1d24aca5853dd8f26fd1a97eb3622acbc46f7bdf96269802c25a46cf
Opcode Fuzzy Hash: 518305beab2af7f7448f46251e0551b1fe354645419727d614e3ae1f13e98812
Instruction Fuzzy Hash: 1F112E35600109AFDB10EFA5DD889FFBBBCEB4D315B10406AF902A2251C7749901DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040196E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000103,?), ref: 0040198F
LoadLibraryW.KERNEL32(?), ref: 004019DB

Strings

HTMLAYOUT, xrefs: 004019C3
htmlayout.dll, xrefs: 004019AD

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: LibraryLoadPathTemp
String ID: HTMLAYOUT$htmlayout.dll
API String ID: 1483161324-2382852306
Opcode ID: e960e21d78d1ae5ad20f9f79a2075018b3328378a562535e321627666c4a5d81
Instruction ID: 6331d88366f79d09ef44652b39a10c8b0e618bf6c13ab4c123d8d644c5d9ff0f
Opcode Fuzzy Hash: e960e21d78d1ae5ad20f9f79a2075018b3328378a562535e321627666c4a5d81
Instruction Fuzzy Hash: 3E01F7B2B0130DAADB20DBA4DC56BEB77FCEB44344F104176E81AE71D1E6349B08C658

Uniqueness

Uniqueness Score: -1.00%

Function 00404520 Relevance: 4.6, APIs: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 0040458B
_memmove.LIBCMT ref: 004045C5
_memmove.LIBCMT ref: 004045DF

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: da11ffc6254176748c6d125490bfd6c9b072b5a764866eec23804c336a4009d9
Instruction ID: 65e9f65510cc0a37031750185b7e9495de23893c3ced0783b30cabe660683ad7
Opcode Fuzzy Hash: da11ffc6254176748c6d125490bfd6c9b072b5a764866eec23804c336a4009d9
Instruction Fuzzy Hash: 00314BB1610B009FC764DF79DA80967B3E9FBC8314B008A6ED94A87B44E675F800CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00429BD4 Relevance: 4.5, APIs: 3, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00429BEE

Part of subcall function 0042AD8C: __FF_MSGBANNER.LIBCMT ref: 0042ADAF
Part of subcall function 0042AD8C: __NMSG_WRITE.LIBCMT ref: 0042ADB6
Part of subcall function 0042AD8C: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,0042CA27,00000001,00000001,00000001,?,0042DB18,00000018,004333D0,0000000C,0042DBA9), ref: 0042AE03

std::bad_exception::bad_exception.LIBCMT ref: 00429C25
__CxxThrowException@8.LIBCMT ref: 00429C33

Part of subcall function 00429B6A: std::exception::exception.LIBCMT ref: 00429B76

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 2138351685-0
Opcode ID: ae7820c94cfebbf9c7d89e35ce583fcb0d2bd5b5b4d4198207abc5bc5e14436e
Instruction ID: 471027db271056a619afcf3bb428b00acc562f7b6dac88000fe9580d0c48a08d
Opcode Fuzzy Hash: ae7820c94cfebbf9c7d89e35ce583fcb0d2bd5b5b4d4198207abc5bc5e14436e
Instruction Fuzzy Hash: 97F0E930B002352BCF186B22FC0395E3B68AB01719FA4446BFC0155191DF6CAE11865E

Uniqueness

Uniqueness Score: -1.00%

Function 004010C3 Relevance: 4.5, APIs: 3, Instructions: 26fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 004010D0
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004010E4
FindCloseChangeNotification.KERNEL32(?), ref: 004010F2

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: File$ChangeCloseFindNotificationPointerWrite
String ID:
API String ID: 2088425310-0
Opcode ID: 1002a22316de52ea5788a1ba0b74fc4a1cb8523fe08b3c32eab6c29cee157856
Instruction ID: 18ab1dfcabc32ec26dcb0b6fad4685691ae14b671c62a4fd2cc7cd1d940cdffd
Opcode Fuzzy Hash: 1002a22316de52ea5788a1ba0b74fc4a1cb8523fe08b3c32eab6c29cee157856
Instruction Fuzzy Hash: D2E09272501128BBCF215FA2DC08DDB7FADFF096A2B108068BE0AD6164D731DA51DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 00401166 Relevance: 3.8, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000), ref: 00401183
VirtualAlloc.KERNEL32(00000000,00000002,00003000,00000040), ref: 00401198
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000), ref: 004011B0

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ByteCharMultiWide$AllocVirtual
String ID:
API String ID: 681469954-0
Opcode ID: 05b1766ab735f38e4f4e05d2b4678030cf6ab776469cd64b41af7fe1176e1849
Instruction ID: 1f1c780e14bf0ead77e861e0243f11b59c76169c223fe8d86e92b6732d1fc7a3
Opcode Fuzzy Hash: 05b1766ab735f38e4f4e05d2b4678030cf6ab776469cd64b41af7fe1176e1849
Instruction Fuzzy Hash: DDF03CB6600208BFDF108F98CCC5EAB7BADEB48354F144426FB01EB250C2B1DE408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403ACB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI(80000001,Software\ExpressFiles,?,?,?,00000000,?,?,?,00402BD6,soft_id,?,?,?), ref: 00403AF6

Strings

Software\ExpressFiles, xrefs: 00403AE5

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Value
String ID: Software\ExpressFiles
API String ID: 3702945584-156859950
Opcode ID: 20405fce97bd1ac7ccf90d8dfa48947633487e1fb1647966ff93ed912ce88414
Instruction ID: 608e246719388f5a1aae000e54e458d4760c35a87e0defe669d5d9b9d49f80b1
Opcode Fuzzy Hash: 20405fce97bd1ac7ccf90d8dfa48947633487e1fb1647966ff93ed912ce88414
Instruction Fuzzy Hash: 38E0ECB195020CBFDF019F90CC45EEE7FBCEB00319F204155B911A2150D6B1A7889B54

Uniqueness

Uniqueness Score: -1.00%

Function 00404E1D Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00404ECB

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 489be3f4be08b020cefb301c32b67d876261a2f805ba539832233cd49025af64
Instruction ID: d65680495112752c7dc90d011e2f438480a1607846d799313952db2bd71e3e80
Opcode Fuzzy Hash: 489be3f4be08b020cefb301c32b67d876261a2f805ba539832233cd49025af64
Instruction Fuzzy Hash: BA414DB5A0061ADBCB18CF99D4905AEF7B2FF84320F24817AD91567B80D3799D91CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7F2 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040C4B3,00000000,?,00000000,00000000,00000000,?,0040AFE9,00000001,00000214,?,0040771A), ref: 0040F835

Part of subcall function 00409704: __getptd_noexit.LIBCMT ref: 00409704

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 8d1d494144ce96ac9ab037ead3798bbbb1d6e4c57190651d7e85f7cfa6c31290
Instruction ID: 99be9a6cd4f41ca11fa1f17ff044f0ae951717072ebf1a64515fa5badfe77aca
Opcode Fuzzy Hash: 8d1d494144ce96ac9ab037ead3798bbbb1d6e4c57190651d7e85f7cfa6c31290
Instruction Fuzzy Hash: 1F01B5373006159AEB34AF26DC54BE73794BB81764F04C63AE805EBAE0D738D804C688

Uniqueness

Uniqueness Score: -1.00%

Function 0042D560 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,0042A87A,?), ref: 0042D575

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a5a838e7fe24164372ae57fd8a80475c256e210be9bcdf24cbcb5cf11a3bf7fe
Instruction ID: d95a6ebd64e4a061f1d3dfde2b7553916d1fc83088e3a99c13ba90a853612b66
Opcode Fuzzy Hash: a5a838e7fe24164372ae57fd8a80475c256e210be9bcdf24cbcb5cf11a3bf7fe
Instruction Fuzzy Hash: 2BD05E72A503456EDB105F71BC08B223BDC97843A9F418436F80CC6260E675C580CA08

Uniqueness

Uniqueness Score: -1.00%

Function 0042B41A Relevance: 1.5, APIs: 1, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMT ref: 0042B41C

Part of subcall function 0042B3A8: TlsGetValue.KERNEL32(00000000,?,0042B421,00000000,0042EADC,00435E70,00000000,00000314,?,0042B333,00435E70,Microsoft Visual C++ Runtime Library,00012010), ref: 0042B3BA
Part of subcall function 0042B3A8: TlsGetValue.KERNEL32(00000005,?,0042B421,00000000,0042EADC,00435E70,00000000,00000314,?,0042B333,00435E70,Microsoft Visual C++ Runtime Library,00012010), ref: 0042B3D1
Part of subcall function 0042B3A8: RtlEncodePointer.NTDLL(00000000,?,0042B421,00000000,0042EADC,00435E70,00000000,00000314,?,0042B333,00435E70,Microsoft Visual C++ Runtime Library,00012010), ref: 0042B40F

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 0bc9c543787971e3b1d343c2b1e75351b74aa16b40d2e05a458cf4bed750fbdb
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE87 Relevance: 1.5, APIs: 1, Instructions: 3COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,0040FDB2,0041C5E8,00000314,00000000,?,?,?,?,?,0040CF5B,0041C5E8,Microsoft Visual C++ Runtime Library,00012010), ref: 0040AE89

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 9c47c8599279ca659e19a4a34ef5265a08438dad85874766fac4c2d4d715bbba
Instruction ID: d9040f0bc38fbc7d36e3751f807e54773a78b8d0ecb468e5d3b116a1ff322665
Opcode Fuzzy Hash: 9c47c8599279ca659e19a4a34ef5265a08438dad85874766fac4c2d4d715bbba
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402B22 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

SHGetValueA.SHLWAPI(80000001,Software\ExpressFiles,install_date,?,?,?,?,?,00000000), ref: 00402B6F
__time64.LIBCMT ref: 00402B7D

Part of subcall function 00407846: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00402B82,?,?,?,?,?,00000000), ref: 00407851
Part of subcall function 00407846: __aulldiv.LIBCMT ref: 00407871

__localtime64_s.LIBCMT ref: 00402B8B

Part of subcall function 00407338: __make__time64_t.LIBCMT ref: 00407342

SHSetValueA.SHLWAPI(80000001,Software\ExpressFiles,install_date,0000000B,?,00000004,?,?,00000000), ref: 00402BB8
GetVersionExW.KERNEL32(?,?,?,?,?,00000000), ref: 00402BED
CoCreateGuid.OLE32(?,?,?,?,?,00000000), ref: 00402BF7
UuidToStringW.RPCRT4(?,?), ref: 00402C0C
__snwprintf.LIBCMT ref: 00402C3C
RpcStringFreeW.RPCRT4(?), ref: 00402C4B
SHSetValueW.SHLWAPI(80000002,Software\ExpressFiles,soft_id,00000001,?,?,?,?,?,?,00000000), ref: 00402C81

Strings

0.2, xrefs: 00402C1C
install_date, xrefs: 00402B5E, 00402BAE
%d-%d-%s-%s, xrefs: 00402C31
Software\ExpressFiles, xrefs: 00402B63, 00402B68, 00402BB3
Software\ExpressFiles, xrefs: 00402C77
soft_id, xrefs: 00402BCB, 00402BD0, 00402C52, 00402C76

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Value$StringTime$CreateFileFreeGuidSystemUuidVersion__aulldiv__localtime64_s__make__time64_t__snwprintf__time64
String ID: %d-%d-%s-%s$0.2$Software\ExpressFiles$Software\ExpressFiles$install_date$soft_id
API String ID: 4141727444-1856787414
Opcode ID: eefa653f5e7ff2f05660b9fe913b1b71eb09b473b2c03475477d67c111d02e81
Instruction ID: fe0587ad8c25b214b18f9572d37301a14eab849dd3bee3dc094f57e566f071e1
Opcode Fuzzy Hash: eefa653f5e7ff2f05660b9fe913b1b71eb09b473b2c03475477d67c111d02e81
Instruction Fuzzy Hash: 894151B2D00219AFDB10DF95DC49EEB77BCEB45705F14807AF504E6281EB789A448B54

Uniqueness

Uniqueness Score: -1.00%

Function 004014D8 Relevance: 22.6, APIs: 15, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?), ref: 004014F9
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00401511
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 0040152C
GetLastError.KERNEL32 ref: 00401532
GetProcessHeap.KERNEL32(00000000,?), ref: 00401541
HeapAlloc.KERNEL32(00000000), ref: 00401548
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 00401561
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00401569
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 0040157A
SetLastError.KERNEL32(00000000), ref: 0040158C
GetLastError.KERNEL32 ref: 00401592
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004015A0
HeapFree.KERNEL32(00000000), ref: 004015A7
CloseHandle.KERNEL32(?), ref: 004015BB
CloseHandle.KERNEL32(?), ref: 004015C5

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: HeapProcess$ErrorLastToken$AuthorityCloseHandleInformationOpen$AllocCountFree
String ID:
API String ID: 832583064-0
Opcode ID: 8ddd707a23ef1381d7aa055e2e7cdc2ba439548caab8067176f016abf1882ce6
Instruction ID: cd06fbe20429e85700cefaa667a7ad31a008de8282c6953e1517943ff0d00095
Opcode Fuzzy Hash: 8ddd707a23ef1381d7aa055e2e7cdc2ba439548caab8067176f016abf1882ce6
Instruction Fuzzy Hash: 0A312B35A00214FFCB219FA5DC489AEBFB9EF88702B108476E506E6264D7359F40DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00402025 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 90windowCOMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,00000000,00000000), ref: 004020B2
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000,?,00000000,00000000), ref: 004020C0

Part of subcall function 004018BE: LockResource.KERNEL32(00000000), ref: 004018F4
Part of subcall function 004018BE: SizeofResource.KERNEL32(00000000,00000000), ref: 00401903
Part of subcall function 004018BE: CreateFileW.KERNEL32(?,C0000000,00000001,?,00000004,00000000,00000000), ref: 0040192E
Part of subcall function 004018BE: VirtualFree.KERNELBASE(?,00000000,00000000,00008000), ref: 00401957
Part of subcall function 004018BE: FreeResource.KERNEL32(?), ref: 00401960

MessageBoxW.USER32(00000000,?,Cant install file,00000000), ref: 0040211C

Strings

HTMLAYOUT, xrefs: 004020A5
EXPRESSDL, xrefs: 00402084, 004020D2
Cant install file, xrefs: 00402112
current_language, xrefs: 004020F2

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Resource$DescriptorFreeSecurity$CreateDaclFileInitializeLockMessageSizeofVirtual
String ID: Cant install file$EXPRESSDL$HTMLAYOUT$current_language
API String ID: 3206630221-1876142429
Opcode ID: a56b00f4c97051ca857085cc66a698f39bdd03144368d434a3644f13f3d71448
Instruction ID: 851dfdb07ba9541c09c6afe9adf1c76dba9b76a8b086b435370ddc23c2f46f8f
Opcode Fuzzy Hash: a56b00f4c97051ca857085cc66a698f39bdd03144368d434a3644f13f3d71448
Instruction Fuzzy Hash: 5E318F72900208AFCB00DFE8D9859EEBBB8FF08304B14447EE515BB291DB755A08CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004012DE Relevance: 12.1, APIs: 8, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00401376
FindNextFileW.KERNEL32(?,?), ref: 004013BB
RemoveDirectoryW.KERNEL32(?), ref: 0040143B
DeleteFileW.KERNEL32(?), ref: 0040145C
GetLastError.KERNEL32 ref: 00401481
FindClose.KERNEL32(?), ref: 004014A6
RemoveDirectoryW.KERNEL32(?), ref: 004014B2
FindClose.KERNEL32(?), ref: 004014CD

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Find$File$CloseDirectoryRemove$DeleteErrorFirstLastNext
String ID:
API String ID: 4094345817-0
Opcode ID: 9f26448009e526f83ebc6f0518f015aa218cabc787c2e521b2e56f23c3433db6
Instruction ID: 9d3b2c5c95fc12cb8e65189a06da6644579f1a43890bd4255a4d0fc6e33bf259
Opcode Fuzzy Hash: 9f26448009e526f83ebc6f0518f015aa218cabc787c2e521b2e56f23c3433db6
Instruction Fuzzy Hash: D851A27190021A8ACF209F78CC587EA76F5EF54314F0045F6E809E32A0E7398E85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 9.0, APIs: 6, Instructions: 48processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040101C
Process32FirstW.KERNEL32(00000000,?), ref: 0040103A
PathFindFileNameW.SHLWAPI(?), ref: 0040104A
StrCmpIW.SHLWAPI(00000000), ref: 00401051
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040106E
CloseHandle.KERNEL32(00000000), ref: 00401079

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Process32$CloseCreateFileFindFirstHandleNameNextPathSnapshotToolhelp32
String ID:
API String ID: 1071957298-0
Opcode ID: 595043d36cf4786aa7230ef8d7cb72eadc54ed786f3665149f4eed60cbc25799
Instruction ID: 044b20cbf957b27d40a084a7c25bcf388f2ca335a17be3ab456cbbed34d25f56
Opcode Fuzzy Hash: 595043d36cf4786aa7230ef8d7cb72eadc54ed786f3665149f4eed60cbc25799
Instruction Fuzzy Hash: 0C019231A01114ABC7209F64DD4DBEE7BBCAB09715F0042B5E911E21E0D7389F44CAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405C10 Relevance: 8.1, Strings: 6, Instructions: 579COMMON

Download Yara Rule

Strings

invalid literal/length code, xrefs: 004062D2
invalid distance code, xrefs: 004062B6
Genu, xrefs: 00405E17
ntel, xrefs: 00405E1F
invalid distance too far back, xrefs: 004062E2
ineI, xrefs: 00405E27

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID: Genu$ineI$invalid distance code$invalid distance too far back$invalid literal/length code$ntel
API String ID: 0-3089872807
Opcode ID: 513ef69d99ebfe96f6b737fb9ef80941e8ad18bf52fc0e232d7b113774a9aff3
Instruction ID: 23372f719c00d966d0f1818c55a8ac02872f5530a4abc751a3123851786869ee
Opcode Fuzzy Hash: 513ef69d99ebfe96f6b737fb9ef80941e8ad18bf52fc0e232d7b113774a9aff3
Instruction Fuzzy Hash: 85123731A087018FDB14DE38C58421BBBE1EB88354F15863EE896E7B81D3799D59CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040707A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004086DC
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004086F1
UnhandledExceptionFilter.KERNEL32(00415FA4), ref: 004086FC
GetCurrentProcess.KERNEL32(C0000409), ref: 00408718
TerminateProcess.KERNEL32(00000000), ref: 0040871F

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5b5b72d1700a22a51e411b3c2e6bb2feb723ea7ea0e438cce9ac0782e312d62d
Instruction ID: 16680594e438a0b59e92e78eabb9926e8ddda0bd970108a2568b24566f5cb839
Opcode Fuzzy Hash: 5b5b72d1700a22a51e411b3c2e6bb2feb723ea7ea0e438cce9ac0782e312d62d
Instruction Fuzzy Hash: 1221ADB4991304EFD741DFA5FD897843BA4BB08305F1091BAE50897671E7B49A808F0D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E826 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004302AB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004302C0
UnhandledExceptionFilter.KERNEL32(00432A3C), ref: 004302CB
GetCurrentProcess.KERNEL32(C0000409), ref: 004302E7
TerminateProcess.KERNEL32(00000000), ref: 004302EE

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 35d8b0a3087576b72b4237ad93d7b4cf0bbcec985a4dee296e98998e35bfda81
Instruction ID: dda2c53026e1a0e8fe149a03d53433f81d4cd3519b73b4c8d32149e6793a4a33
Opcode Fuzzy Hash: 35d8b0a3087576b72b4237ad93d7b4cf0bbcec985a4dee296e98998e35bfda81
Instruction Fuzzy Hash: F421FEB4900246FFC700EF2AFD8AA043BB0BB08344F52B03AE41987264E7B549848F5D

Uniqueness

Uniqueness Score: -1.00%

Function 004063B0 Relevance: 2.9, Strings: 2, Instructions: 390COMMON

Download Yara Rule

Strings

@, xrefs: 00406780
X>A, xrefs: 00406572

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID: @$X>A
API String ID: 0-2469429838
Opcode ID: 0575c887382b4c9056e03da4f7b83a1774cb174f10fce066d0216b3e4764987c
Instruction ID: c0323352c71fd4c83f5076639bd8333173ffdf98e45b54bd3c6e0153d3c606c6
Opcode Fuzzy Hash: 0575c887382b4c9056e03da4f7b83a1774cb174f10fce066d0216b3e4764987c
Instruction Fuzzy Hash: D3F15E75E002198FCF24CFA8C5802ADBBB1FF98314F25457ED846AB384DB799956CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00401A2A Relevance: 1.5, APIs: 1, Instructions: 37comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00418014,00000000,00000001,00418024,?,00401D3C), ref: 00401A42

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b59788361d556036c6ead607468fb3b27824885aa9d606312dd8889d99c14882
Instruction ID: 9669c3f696ff775881e3c6243a681e9f0239a2346b5aaf48d4c0b54247478413
Opcode Fuzzy Hash: b59788361d556036c6ead607468fb3b27824885aa9d606312dd8889d99c14882
Instruction Fuzzy Hash: F2F049303027029BDB248E25CC48F6376A5AF40B06F10882DA196DA6E4D7B8E980CF18

Uniqueness

Uniqueness Score: -1.00%

Function 0040D057 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000D015), ref: 0040D05C

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c6f671298aa8306924dfdba1ad9fe3c225a693b469c98f0f13a405b2b0feebde
Instruction ID: 05696fe55d69e19891b1b5b984a5015ee42096844b8e7f5f1e3276c6b97f2912
Opcode Fuzzy Hash: c6f671298aa8306924dfdba1ad9fe3c225a693b469c98f0f13a405b2b0feebde
Instruction Fuzzy Hash: 8B9002646A1140569A005FB05D0D74565A45ADC70BB5144756219E8098DE644105661A

Uniqueness

Uniqueness Score: -1.00%

Function 00740025 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

", xrefs: 006587FB

Memory Dump Source

Source File: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: e8758db0e99e8fcea7555fa9d2641066f37a2482aaa06230641a43a236fbfd4e
Instruction ID: b2cb2a2cde6401a48ccb7f509ef8d06b458c6a369460e00cb97887ab1918e747
Opcode Fuzzy Hash: e8758db0e99e8fcea7555fa9d2641066f37a2482aaa06230641a43a236fbfd4e
Instruction Fuzzy Hash: 4E11337550C345FEC702EB14C1826AA7F93BF90380F14844EF98527A12E6789569AB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004BD30F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a7f9398a2cfe3d3b7bead3f721c4cbe39a86abe3ea0e77f28ff9391eaea01d9
Instruction ID: e1993a3340d3fc72cad59d1c3d45e16d4d5593cdc44aa4144d82d23be8916c37
Opcode Fuzzy Hash: 6a7f9398a2cfe3d3b7bead3f721c4cbe39a86abe3ea0e77f28ff9391eaea01d9
Instruction Fuzzy Hash: 799105B6E051995FCB059F68C8A01F97BF2EF66210B0D80E9D9D0DB347D139961BCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00427D70 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33c0485eb41936b300fb5aad2963a1aba252e7099ae6d0aa04c09c3ff597148
Instruction ID: 7b0475f07a8823306a501a767e7839936b0c34f56a6fc7186211326b821bed15
Opcode Fuzzy Hash: a33c0485eb41936b300fb5aad2963a1aba252e7099ae6d0aa04c09c3ff597148
Instruction Fuzzy Hash: 4C8127B2E0519A5FDB059F68C8A01F97BF2EF66204B0D80E9D9D0DB347D139961BCB90

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9326100741b2f08c687ab723f092331b973ed24116abba679b17efeba75b6248
Instruction ID: 88d688d29e1a3f70c457dfcbf34bd088a50aa66e4d8e9cdd437568f1f1431993
Opcode Fuzzy Hash: 9326100741b2f08c687ab723f092331b973ed24116abba679b17efeba75b6248
Instruction Fuzzy Hash: 8561603666155357E350CF6DFCC076637A2EBCA701F1AC531DA108B6A6C739EA2386C8

Uniqueness

Uniqueness Score: -1.00%

Function 00424944 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdc87c66b028c3d17e28a6d295e6691f78296d3e33762d35ad1643c124583432
Instruction ID: 5ec589f9b70ae1655e479850c9781525016180733e2f0e49920e33c2e6229f04
Opcode Fuzzy Hash: fdc87c66b028c3d17e28a6d295e6691f78296d3e33762d35ad1643c124583432
Instruction Fuzzy Hash: 4AF05E3A548399DFC711DB9084804EEFBF1AA9A311F48984DEAC413301E366AA5DD712

Uniqueness

Uniqueness Score: -1.00%

Function 00402126 Relevance: 86.0, APIs: 21, Strings: 28, Instructions: 216fileCOMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00402162
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,DisplayName,00000001,ExpressFiles,0000001A,?,004180A0,?,00000000), ref: 00402190
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,UninstallString,00000001,?,?,?,004180A0,?,00000000), ref: 004021AD
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,DisplayIcon,00000001,?,?,?,004180A0,?,00000000), ref: 004021E6
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,Publisher,00000001,http://www.express-files.com/,0000003C,?,004180A0,?,00000000), ref: 004021F8
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,InstallLocation,00000001,?,?,?,004180A0,?,00000000), ref: 00402233
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,URLInfoAbout,00000001,http://www.express-files.com/,0000003C,?,004180A0,?,00000000), ref: 00402245
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles,DisplayVersion,00000001,1.2.0,0000000C,?,004180A0,?,00000000), ref: 00402257
SHSetValueW.SHLWAPI(80000000,Magnets,00418054,00000001,Magnets URI,00000018,?,004180A0,?,00000000), ref: 00402272
SHSetValueW.SHLWAPI(80000000,Magnets,Content Type,00000001,application/x-magnets,0000002C,?,004180A0,?,00000000), ref: 00402288
SHSetValueW.SHLWAPI(80000000,Magnets,URL Protocol,00000001,00418054,00000000,?,004180A0,?,00000000), ref: 0040229E
SHSetValueW.SHLWAPI(80000000,Magnets\shell,00418054,00000001,open,0000000A,?,004180A0,?,00000000), ref: 004022B4
__snwprintf.LIBCMT ref: 004022CD
SHSetValueW.SHLWAPI(80000000,Magnets\DefaultIcon,00418054,00000001,?,?,?,?,?,?,?,004180A0,?,00000000), ref: 004022F4
__snwprintf.LIBCMT ref: 0040230F
SHSetValueW.SHLWAPI(80000000,Magnets\shell\open\command,00418054,00000001,?,?), ref: 00402336
__snwprintf.LIBCMT ref: 0040234F
SHSetValueW.SHLWAPI(80000002,Software\Microsoft\Windows\CurrentVersion\Run,ExpressFiles,00000001,?,?), ref: 0040237A
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Internet Explorer\ProtocolExecute\magnets,WarnOnOpen,00000004,?,00000004), ref: 0040239A
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 004023A9
CopyFileW.KERNEL32(?,?,00000000), ref: 004023C1

Strings

UninstallString, xrefs: 004021A6
"%s",0, xrefs: 004022C2
WarnOnOpen, xrefs: 00402387
URL Protocol, xrefs: 00402293
1.2.0, xrefs: 00402249
DisplayName, xrefs: 00402179
Magnets\shell, xrefs: 004022AE
DisplayIcon, xrefs: 004021DF
http://www.express-files.com/, xrefs: 00402237
Magnets, xrefs: 00402267, 00402282, 00402298
Magnets URI, xrefs: 0040225B
ExpressFiles, xrefs: 00402172, 0040236B
"%s", xrefs: 0040214B
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00402370
Magnets\shell\open\command, xrefs: 00402330
http://www.express-files.com/, xrefs: 004021EA
Content Type, xrefs: 0040227D
open, xrefs: 004022A2
Software\Microsoft\Internet Explorer\ProtocolExecute\magnets, xrefs: 0040238C
Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles, xrefs: 0040217E, 00402183, 004021AB, 004021E4, 004021F6, 00402231, 00402243, 00402255
application/x-magnets, xrefs: 00402276
"%s" -tray, xrefs: 00402344
URLInfoAbout, xrefs: 0040223E
InstallLocation, xrefs: 0040222C
DisplayVersion, xrefs: 00402250
Publisher, xrefs: 004021F1
"%s" "%c1", xrefs: 00402304
Magnets\DefaultIcon, xrefs: 004022EE

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Value$__snwprintf$File$CopyModuleName
String ID: "%s"$"%s" "%c1"$"%s" -tray$"%s",0$1.2.0$Content Type$DisplayIcon$DisplayName$DisplayVersion$ExpressFiles$InstallLocation$Magnets$Magnets URI$Magnets\DefaultIcon$Magnets\shell$Magnets\shell\open\command$Publisher$Software\Microsoft\Internet Explorer\ProtocolExecute\magnets$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles$URL Protocol$URLInfoAbout$UninstallString$WarnOnOpen$application/x-magnets$http://www.express-files.com/$http://www.express-files.com/$open
API String ID: 1960140225-1323249820
Opcode ID: b9ff41efca294e75e0ad7fcc8b69b57377e6f820bfab63544106d7de28dff8df
Instruction ID: 782461ce589b93ffc606f05bf7dd20060a5cf2829273daad732b555a9d6cb1a1
Opcode Fuzzy Hash: b9ff41efca294e75e0ad7fcc8b69b57377e6f820bfab63544106d7de28dff8df
Instruction Fuzzy Hash: 006166B1BC031D7AEB209B508C8AFDB7B6DDB14B44F10459B7604B61C2DEF95BC48A68

Uniqueness

Uniqueness Score: -1.00%

Function 00403CB2 Relevance: 49.1, APIs: 21, Strings: 7, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00401DE8: __snwprintf.LIBCMT ref: 00401E6E
Part of subcall function 00401DE8: InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,00000000,00000000), ref: 00401E7F
Part of subcall function 00401DE8: SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000,?,00000000,00000000), ref: 00401E90
Part of subcall function 00401DE8: SetSecurityDescriptorGroup.ADVAPI32(?,00000000,00000000,?,00000000,00000000), ref: 00401E9F
Part of subcall function 00401DE8: SetSecurityDescriptorSacl.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000), ref: 00401EAF
Part of subcall function 00401DE8: CreateDirectoryW.KERNEL32(?,?,?,00000000,00000000), ref: 00401EE3
Part of subcall function 00401DE8: GetLastError.KERNEL32(?,00000000,00000000), ref: 00401EED
Part of subcall function 00401DE8: __snwprintf.LIBCMT ref: 00401F12
Part of subcall function 00401DE8: __snwprintf.LIBCMT ref: 00401F2C
Part of subcall function 00401DE8: __snwprintf.LIBCMT ref: 00401F46

GetTempPathW.KERNEL32(00000103,?), ref: 00403CE4
GetTickCount.KERNEL32 ref: 00403D11
__snwprintf.LIBCMT ref: 00403D20
MoveFileExW.KERNEL32(?,?,00000001), ref: 00403D3E
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403D4B
GetTickCount.KERNEL32 ref: 00403D4D
__snwprintf.LIBCMT ref: 00403D61
MoveFileExW.KERNEL32(?,?,00000001), ref: 00403D79
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403D86
GetTickCount.KERNEL32 ref: 00403D88
__snwprintf.LIBCMT ref: 00403D9C
MoveFileExW.KERNEL32(?,?,00000001), ref: 00403DB4
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403DC1
GetTickCount.KERNEL32 ref: 00403DC3
__snwprintf.LIBCMT ref: 00403DD7

Part of subcall function 00407897: __flsbuf.LIBCMT ref: 00407941
Part of subcall function 00407897: __flsbuf.LIBCMT ref: 00407959

MoveFileExW.KERNEL32(?,?,00000001), ref: 00403DEF
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403DFC
GetTickCount.KERNEL32 ref: 00403DFE
__snwprintf.LIBCMT ref: 00403E12
MoveFileExW.KERNEL32(?,?,00000001), ref: 00403E2A
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403E37

Part of subcall function 0040108F: OpenProcess.KERNEL32(00000001,00000000,00000000,74CB40A0,00403E43), ref: 0040109E
Part of subcall function 0040108F: TerminateProcess.KERNEL32(00000000,000000FF), ref: 004010AD
Part of subcall function 0040108F: CloseHandle.KERNEL32(00000000), ref: 004010B4

Strings

expressdl%u.tmp, xrefs: 00403D8B
ExpressFiles%u.tmp, xrefs: 00403D50
dht%u.tmp, xrefs: 00403E01
ExpressFiles.exe, xrefs: 00403E39
ExpressDL.exe, xrefs: 00403E43
htmlayout%u.tmp, xrefs: 00403DC6
uninstall%u.tmp, xrefs: 00403D14

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: FileMove$__snwprintf$CountTick$DescriptorSecurity$Process__flsbuf$CloseCreateDaclDirectoryErrorGroupHandleInitializeLastOpenPathSaclTempTerminate
String ID: ExpressDL.exe$ExpressFiles%u.tmp$ExpressFiles.exe$dht%u.tmp$expressdl%u.tmp$htmlayout%u.tmp$uninstall%u.tmp
API String ID: 1038718190-2835777480
Opcode ID: 5f5026c0a2fe4f820c53f64f05fb3032a8dee728c22abfa38bd4ebab12d2f3d0
Instruction ID: 87d98308fe2fa0717cbc295282570b70ae07b1cec1c3165c2f9ecb787386cf9f
Opcode Fuzzy Hash: 5f5026c0a2fe4f820c53f64f05fb3032a8dee728c22abfa38bd4ebab12d2f3d0
Instruction Fuzzy Hash: 61415771D4021C7ADB11EB61CC89FDA7B7CEF14704F0405A6B618A60D1DB755B908FE9

Uniqueness

Uniqueness Score: -1.00%

Function 00401DE8 Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 167COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00401E6E
InitializeSecurityDescriptor.ADVAPI32(?,00000001,?,00000000,00000000), ref: 00401E7F
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,00000000,00000000,?,00000000,00000000), ref: 00401E90
SetSecurityDescriptorGroup.ADVAPI32(?,00000000,00000000,?,00000000,00000000), ref: 00401E9F
SetSecurityDescriptorSacl.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000), ref: 00401EAF
CreateDirectoryW.KERNEL32(?,?,?,00000000,00000000), ref: 00401EE3
GetLastError.KERNEL32(?,00000000,00000000), ref: 00401EED
__snwprintf.LIBCMT ref: 00401F12
__snwprintf.LIBCMT ref: 00401F2C
__snwprintf.LIBCMT ref: 00401F46
__snwprintf.LIBCMT ref: 00401F60
__snwprintf.LIBCMT ref: 00401F7D
__snwprintf.LIBCMT ref: 00401F97
__snwprintf.LIBCMT ref: 00401FB1
CreateDirectoryW.KERNEL32(?,00000000), ref: 00401FC2
GetLastError.KERNEL32 ref: 00401FCC
__snwprintf.LIBCMT ref: 00401FFF

Strings

current-cloud.html, xrefs: 00401F4B
language, xrefs: 00401F9C
%s\%s, xrefs: 00401F04, 00401F09, 00401F23, 00401F3D, 00401F57, 00401F74, 00401F8E, 00401FA8, 00401FF6
uninstall.exe, xrefs: 00401F68
EN.ini, xrefs: 00401FEA
ExpressFiles.exe, xrefs: 00401F17
ExpressDL.exe, xrefs: 00401EFE
htmlayout.dll, xrefs: 00401F31
dht.dat, xrefs: 00401F82

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __snwprintf$DescriptorSecurity$CreateDirectoryErrorLast$DaclGroupInitializeSacl
String ID: %s\%s$EN.ini$ExpressDL.exe$ExpressFiles.exe$current-cloud.html$dht.dat$htmlayout.dll$language$uninstall.exe
API String ID: 1648615902-3264171877
Opcode ID: f7a9a732f28109b07b6144d35e2a22889c9252f4ae9d31a3a9022b9d9d3625f9
Instruction ID: 1b564ffcd36949cc2c74559874444057589e5fd4394984ec036ba2af574ed169
Opcode Fuzzy Hash: f7a9a732f28109b07b6144d35e2a22889c9252f4ae9d31a3a9022b9d9d3625f9
Instruction Fuzzy Hash: C6515E72800218BADB20DFA5DC8DEDB7BBCEB49704F0441BAB909E6052D7789684CB74

Uniqueness

Uniqueness Score: -1.00%

Function 004015CE Relevance: 42.1, APIs: 20, Strings: 4, Instructions: 144libraryloaderprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004015F4
GetModuleHandleA.KERNEL32(Kernel32,GetProductInfo), ref: 0040160C
GetProcAddress.KERNEL32(00000000), ref: 00401615
GetCurrentProcessId.KERNEL32(?), ref: 0040161F

Part of subcall function 004014D8: OpenProcess.KERNEL32(00000400,00000000,?), ref: 004014F9
Part of subcall function 004014D8: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00401511
Part of subcall function 004014D8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 0040152C
Part of subcall function 004014D8: GetLastError.KERNEL32 ref: 00401532
Part of subcall function 004014D8: GetProcessHeap.KERNEL32(00000000,?), ref: 00401541
Part of subcall function 004014D8: HeapAlloc.KERNEL32(00000000), ref: 00401548
Part of subcall function 004014D8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 00401561
Part of subcall function 004014D8: GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00401569
Part of subcall function 004014D8: GetSidSubAuthority.ADVAPI32(00000000,?), ref: 0040157A
Part of subcall function 004014D8: SetLastError.KERNEL32(00000000), ref: 0040158C
Part of subcall function 004014D8: GetLastError.KERNEL32 ref: 00401592
Part of subcall function 004014D8: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004015A0
Part of subcall function 004014D8: HeapFree.KERNEL32(00000000), ref: 004015A7
Part of subcall function 004014D8: CloseHandle.KERNEL32(?), ref: 004015BB
Part of subcall function 004014D8: CloseHandle.KERNEL32(?), ref: 004015C5

CreateProcessW.KERNEL32 ref: 0040164C
GetLastError.KERNEL32 ref: 00401656
CloseHandle.KERNEL32(?), ref: 0040166A
CloseHandle.KERNEL32(?), ref: 0040166F
GetModuleHandleA.KERNEL32(Advapi32,CreateProcessWithTokenW), ref: 0040167F
GetProcAddress.KERNEL32(00000000), ref: 00401682
GetShellWindow.USER32 ref: 0040168F
GetWindowThreadProcessId.USER32(00000000,?), ref: 0040169D
OpenProcess.KERNEL32(00000400,00000000,?), ref: 004016AC
OpenProcessToken.ADVAPI32(00000000,00000002,?), ref: 004016C0
DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?), ref: 004016DB
SetLastError.KERNEL32(00000000), ref: 004016FF
GetLastError.KERNEL32 ref: 00401705
CloseHandle.KERNEL32(?), ref: 0040171B
CloseHandle.KERNEL32(?), ref: 00401725
CloseHandle.KERNEL32(00002000), ref: 0040172F

Strings

Kernel32, xrefs: 00401607
Advapi32, xrefs: 0040167A
GetProductInfo, xrefs: 00401602
CreateProcessWithTokenW, xrefs: 00401675

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: HandleProcess$Close$ErrorLast$Token$HeapOpen$AddressAuthorityInformationModuleProcWindow$AllocCountCreateCurrentDuplicateFreeShellThread_memset
String ID: Advapi32$CreateProcessWithTokenW$GetProductInfo$Kernel32
API String ID: 57731014-2586447327
Opcode ID: de440af90c9eb4138c99f53fe2eb7a1ae70592b1cc59fdca0ab05b195316246a
Instruction ID: 9bb44bd2211025a76b721a39ef127812c674402ab68add2ab692ccf74696313f
Opcode Fuzzy Hash: de440af90c9eb4138c99f53fe2eb7a1ae70592b1cc59fdca0ab05b195316246a
Instruction Fuzzy Hash: DD415C71900218BBCB11AFA5CC48AEFBFB8EF08742F144436F505F21A0D7759A41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B180 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004081C4), ref: 0040B188
__mtterm.LIBCMT ref: 0040B194

Part of subcall function 0040AECD: DecodePointer.KERNEL32(00000006,0040B2F6,?,004081C4), ref: 0040AEDE
Part of subcall function 0040AECD: TlsFree.KERNEL32(0000001B,0040B2F6,?,004081C4), ref: 0040AEF8
Part of subcall function 0040AECD: DeleteCriticalSection.KERNEL32(00000000,00000000,778DF3A0,?,0040B2F6,?,004081C4), ref: 0040E6F4
Part of subcall function 0040AECD: _free.LIBCMT ref: 0040E6F7
Part of subcall function 0040AECD: DeleteCriticalSection.KERNEL32(0000001B,778DF3A0,?,0040B2F6,?,004081C4), ref: 0040E71E

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0040B1AA
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0040B1B7
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0040B1C4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0040B1D1
TlsAlloc.KERNEL32(?,004081C4), ref: 0040B221
TlsSetValue.KERNEL32(00000000,?,004081C4), ref: 0040B23C
__init_pointers.LIBCMT ref: 0040B246
EncodePointer.KERNEL32(?,004081C4), ref: 0040B257
EncodePointer.KERNEL32(?,004081C4), ref: 0040B264
EncodePointer.KERNEL32(?,004081C4), ref: 0040B271
EncodePointer.KERNEL32(?,004081C4), ref: 0040B27E
DecodePointer.KERNEL32(0040B051,?,004081C4), ref: 0040B29F
__calloc_crt.LIBCMT ref: 0040B2B4
DecodePointer.KERNEL32(00000000,?,004081C4), ref: 0040B2CE
GetCurrentThreadId.KERNEL32 ref: 0040B2E0

Strings

KERNEL32.DLL, xrefs: 0040B183
FlsGetValue, xrefs: 0040B1AC
FlsAlloc, xrefs: 0040B1A4
FlsSetValue, xrefs: 0040B1B9
FlsFree, xrefs: 0040B1C6

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 075102baf782855bd31803b65f5c8eae9857b4110be79dbdfc8ebdd4ab477078
Instruction ID: 8ef39d3875db1831668df36e5a39cb3dc6a93f4fadec20ff4aff144fe6e17387
Opcode Fuzzy Hash: 075102baf782855bd31803b65f5c8eae9857b4110be79dbdfc8ebdd4ab477078
Instruction Fuzzy Hash: 8B318230980321FAC7116F76FC8969A3EA6EB48761711897BE414E32F1DB38A451DF9C

Uniqueness

Uniqueness Score: -1.00%

Function 00403E6D Relevance: 31.6, APIs: 7, Strings: 11, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00403CB2: GetTempPathW.KERNEL32(00000103,?), ref: 00403CE4
Part of subcall function 00403CB2: GetTickCount.KERNEL32 ref: 00403D11
Part of subcall function 00403CB2: __snwprintf.LIBCMT ref: 00403D20
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,?,00000001), ref: 00403D3E
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403D4B
Part of subcall function 00403CB2: GetTickCount.KERNEL32 ref: 00403D4D
Part of subcall function 00403CB2: __snwprintf.LIBCMT ref: 00403D61
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,?,00000001), ref: 00403D79
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403D86
Part of subcall function 00403CB2: GetTickCount.KERNEL32 ref: 00403D88
Part of subcall function 00403CB2: __snwprintf.LIBCMT ref: 00403D9C
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,?,00000001), ref: 00403DB4
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403DC1
Part of subcall function 00403CB2: GetTickCount.KERNEL32 ref: 00403DC3
Part of subcall function 00403CB2: __snwprintf.LIBCMT ref: 00403DD7
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,?,00000001), ref: 00403DEF
Part of subcall function 00403CB2: MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00403DFC
Part of subcall function 00403CB2: GetTickCount.KERNEL32 ref: 00403DFE

Part of subcall function 00402512: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000019,00000001,?,00000000), ref: 00402537
Part of subcall function 00402512: __snwprintf.LIBCMT ref: 0040255E
Part of subcall function 00402512: DeleteFileW.KERNEL32(?), ref: 00402572

Part of subcall function 004023E3: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000016,00000001,?,?,00000000), ref: 00402408

SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00403EAD
SHDeleteKeyW.SHLWAPI(80000000,Magnets), ref: 00403EC3
SHDeleteKeyW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles), ref: 00403ED0
SHDeleteValueW.SHLWAPI(80000002,Software\Microsoft\Windows\CurrentVersion\Run,ExpressFiles), ref: 00403EE1
SHGetValueA.SHLWAPI(80000001,Software\ExpressFiles,expressdl_starts,?,?,?), ref: 00403F12

Part of subcall function 00403ACB: SHGetValueW.SHLWAPI(80000001,Software\ExpressFiles,?,?,?,00000000,?,?,?,00402BD6,soft_id,?,?,?), ref: 00403AF6

__snwprintf.LIBCMT ref: 00403F5C
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00403F73

Strings

http://express-files.com/uninstall/?sid=%s&aid=%s&d=%lld&s=%u, xrefs: 00403F51
Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles, xrefs: 00403EC5
expressdl_starts, xrefs: 00403F01
LJu, xrefs: 00403F73
Magnets, xrefs: 00403EB9
open, xrefs: 00403F6D
ExpressFiles, xrefs: 00403ED2
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00403ED7
Software\ExpressFiles, xrefs: 00403F06
default-id, xrefs: 00403F30
soft_id, xrefs: 00403F1F

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: File$Move$__snwprintf$CountTick$Delete$PathValue$FolderSpecial$ChangeExecuteNotifyShellTemp
String ID: ExpressFiles$Magnets$Software\ExpressFiles$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Uninstall\ExpressFiles$default-id$expressdl_starts$http://express-files.com/uninstall/?sid=%s&aid=%s&d=%lld&s=%u$open$soft_id$LJu
API String ID: 2473526292-1786823547
Opcode ID: 8f3314ceb96532a4a09adf02fe4baa565363f1e047e6d14583b1ab5ffbcf2750
Instruction ID: 8cee30aa39b64c8435ba161db1776d5d81e0a050d14e0917f465dcd83a494d5c
Opcode Fuzzy Hash: 8f3314ceb96532a4a09adf02fe4baa565363f1e047e6d14583b1ab5ffbcf2750
Instruction Fuzzy Hash: FF21E9726443047BD210AF619C46FEB77ACEB88B05F10452FF954A21C1DE79AA4487AA

Uniqueness

Uniqueness Score: -1.00%

Function 00401BCD Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 166synchronizationwindowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,86AC0E8B), ref: 00401C18

Part of subcall function 00403526: GetTempPathW.KERNEL32(00000103,?,?,?,00000000), ref: 00403565
Part of subcall function 00403526: GetTickCount.KERNEL32 ref: 00403571
Part of subcall function 00403526: __snwprintf.LIBCMT ref: 0040358A
Part of subcall function 00403526: __snwprintf.LIBCMT ref: 004035C4
Part of subcall function 00403526: ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000001), ref: 004035DF

CreateMutexW.KERNEL32(00000000,00000000,{2fd22d30-203e-11e1-8bc2-0800200c9a66}), ref: 00401C2C
GetLastError.KERNEL32 ref: 00401C34
CloseHandle.KERNEL32(00000000), ref: 00401C72
__snwprintf.LIBCMT ref: 00401CDD
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00401CFA
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00401D1E
MessageBoxW.USER32(00000000,ExpressFiles,error,00000000), ref: 00401DBE

Strings

error, xrefs: 00401DB3
LJu, xrefs: 00401CE2
ExpressFilesDL, xrefs: 00401D53
{2fd22d30-203e-11e1-8bc2-0800200c9a66}, xrefs: 00401C25
open, xrefs: 00401CF4, 00401D18
ExpressFiles, xrefs: 00401D40, 00401DB8
default-id, xrefs: 00401CAF, 00401CCD
http://express-files.com/welcome/?sid=%s&aid=%s&b=%d&d=%lld, xrefs: 00401CCE

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ExecuteShell__snwprintf$CloseCountCreateErrorHandleLastMessageMutexPathShowTempTickWindow
String ID: ExpressFiles$ExpressFilesDL$default-id$error$http://express-files.com/welcome/?sid=%s&aid=%s&b=%d&d=%lld$open${2fd22d30-203e-11e1-8bc2-0800200c9a66}$LJu
API String ID: 877578555-727556491
Opcode ID: 464f80dab1f727cc9a5419ad50761d9959ed973649888f5a3de745221c52b686
Instruction ID: 94b84ab5e9e7a7729e18d5922fac55ed15cb8e9bde6a94bb269485d0d21796f3
Opcode Fuzzy Hash: 464f80dab1f727cc9a5419ad50761d9959ed973649888f5a3de745221c52b686
Instruction Fuzzy Hash: 7251C071604345ABC714EF64CCC5EEBBBADFF48314F000A2EF445A32E1DB78A9458699

Uniqueness

Uniqueness Score: -1.00%

Function 0042B50F Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004332A0,0000000C,0042B64A,00000000,00000000,?,00000001,0042B07E,0042AB2A), ref: 0042B521
__crt_waiting_on_module_handle.LIBCMT ref: 0042B52C

Part of subcall function 0042CAF5: Sleep.KERNEL32(000003E8,00000000,?,0042B472,KERNEL32.DLL,?,0042B4BE,?,00000001,0042B07E,0042AB2A), ref: 0042CB01
Part of subcall function 0042CAF5: GetModuleHandleW.KERNEL32(00000001,?,0042B472,KERNEL32.DLL,?,0042B4BE,?,00000001,0042B07E,0042AB2A), ref: 0042CB0A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0042B555
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0042B565
__lock.LIBCMT ref: 0042B587
InterlockedIncrement.KERNEL32(?), ref: 0042B594
__lock.LIBCMT ref: 0042B5A8
___addlocaleref.LIBCMT ref: 0042B5C6

Strings

DecodePointer, xrefs: 0042B55D
EncodePointer, xrefs: 0042B549
KERNEL32.DLL, xrefs: 0042B51B, 0042B520, 0042B52B
WC, xrefs: 0042B5BB

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$WC
API String ID: 1028249917-1000047951
Opcode ID: 068befcd3704ab22be56119cbdaab9ce8b4069309a1ce007bbbfaeecaf5c9563
Instruction ID: 1b120451ca6417ae19f4159e3bff0f8d161a46127c804540cd555a8bc0afc345
Opcode Fuzzy Hash: 068befcd3704ab22be56119cbdaab9ce8b4069309a1ce007bbbfaeecaf5c9563
Instruction Fuzzy Hash: C2117271A00711EFD710EF66AC41B4ABBE0EF04318F90956FE499972A0CB78AA40CF5C

Uniqueness

Uniqueness Score: -1.00%

Function 00406E3F Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 206libraryCOMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00406EB8
LoadLibraryA.KERNEL32(?), ref: 00406F31
GetLastError.KERNEL32 ref: 00406F3D
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00406F70

Strings

$, xrefs: 00406E8D

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 4cc751d35614a2170bcfc8ad77c587006582ec1851604b5b53bcc06281603ec1
Instruction ID: ce3bf21f8cd5bf5204e91e3bcffa82e38807681f1fc2b69fdaeef7a32b97048d
Opcode Fuzzy Hash: 4cc751d35614a2170bcfc8ad77c587006582ec1851604b5b53bcc06281603ec1
Instruction Fuzzy Hash: 81812D75A40209AFDB10CFA8D880AAEB7F5EF48711F15813AE905E7390DB74EA44CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00403526 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000103,?,?,?,00000000), ref: 00403565
GetTickCount.KERNEL32 ref: 00403571
__snwprintf.LIBCMT ref: 0040358A

Part of subcall function 004018BE: LockResource.KERNEL32(00000000), ref: 004018F4
Part of subcall function 004018BE: SizeofResource.KERNEL32(00000000,00000000), ref: 00401903
Part of subcall function 004018BE: CreateFileW.KERNEL32(?,C0000000,00000001,?,00000004,00000000,00000000), ref: 0040192E
Part of subcall function 004018BE: VirtualFree.KERNELBASE(?,00000000,00000000,00008000), ref: 00401957
Part of subcall function 004018BE: FreeResource.KERNEL32(?), ref: 00401960

__snwprintf.LIBCMT ref: 004035C4
ShellExecuteW.SHELL32(00000000,open,?,?,00000000,00000001), ref: 004035DF

Strings

/mhp /mnt /mds /babTrack="affID=%s" /s /aflt=babsst /instlref=sst /srcExt=ss, xrefs: 004035BD
BABYLON, xrefs: 0040359F
LJu, xrefs: 004035DF
toolbar%u.exe, xrefs: 0040357C
open, xrefs: 004035D8

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Resource$Free__snwprintf$CountCreateExecuteFileLockPathShellSizeofTempTickVirtual
String ID: /mhp /mnt /mds /babTrack="affID=%s" /s /aflt=babsst /instlref=sst /srcExt=ss$BABYLON$open$toolbar%u.exe$LJu
API String ID: 1741217986-4003238989
Opcode ID: 969bcea8e7ad96532d7f77a97b3582643035614bf12d89063f099dfb46ec4e0a
Instruction ID: c8430cab012f56bf22740aea0caff8f0c4f3e4d2e2727e5e06d85340c95e25f1
Opcode Fuzzy Hash: 969bcea8e7ad96532d7f77a97b3582643035614bf12d89063f099dfb46ec4e0a
Instruction Fuzzy Hash: F311CB71B402087BD710DB64CC89FE73BAC9B14709F14047FB515E21D1F9B5DB448669

Uniqueness

Uniqueness Score: -1.00%

Function 004023E3 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000016,00000001,?,?,00000000), ref: 00402408
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000000), ref: 00402455
GetLastError.KERNEL32(?,?,00000000), ref: 0040245F
__snwprintf.LIBCMT ref: 0040248F
__snwprintf.LIBCMT ref: 004024D6

Strings

\ExpressFiles, xrefs: 00402432
%s\%s.lnk, xrefs: 0040247C, 00402481, 004024CD
Uninstall, xrefs: 00402470
ExpressFiles, xrefs: 004024C1

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __snwprintf$CreateDirectoryErrorFolderLastPathSpecial
String ID: %s\%s.lnk$ExpressFiles$Uninstall$\ExpressFiles
API String ID: 3668843157-709336226
Opcode ID: c508638348ba11594b4e8e434e808cbb48ef80d85f6b57ab3de0574f35e67c7b
Instruction ID: 7fe0aa0ce09214fd93cdcf71aeac9113d88b356813dbc2b8b0a2e5d478c6a899
Opcode Fuzzy Hash: c508638348ba11594b4e8e434e808cbb48ef80d85f6b57ab3de0574f35e67c7b
Instruction Fuzzy Hash: C931DDB2E4021C7ADB10DE50CD89FDB77AC9B14304F4140B6BA0DF61C1E679AA858679

Uniqueness

Uniqueness Score: -1.00%

Function 00403A4F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

OpenFileMappingA.KERNEL32 ref: 00403A62
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,00000000,?,00401C6A,?,?), ref: 00403A78
_memset.LIBCMT ref: 00403A91
_memmove.LIBCMT ref: 00403A9D
OpenEventA.KERNEL32(00000002,00000000,ExpressFilesPipeKeyword,00401C6A,?,?), ref: 00403AAD
SetEvent.KERNEL32(00000000,?,?), ref: 00403ABA
CloseHandle.KERNEL32(00000000,?,?), ref: 00403AC1

Strings

ExpressFilesPipe, xrefs: 00403A54
ExpressFilesPipeKeyword, xrefs: 00403AA5

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: EventFileOpen$CloseHandleMappingView_memmove_memset
String ID: ExpressFilesPipe$ExpressFilesPipeKeyword
API String ID: 292703036-1477078467
Opcode ID: 46c8ae7120435698744864ace500e945a261b782131fe710388ec90a8446f2ae
Instruction ID: fbfab9ed65d3ae908d753507668715f51141cc322939da1c50132bc64de82bf2
Opcode Fuzzy Hash: 46c8ae7120435698744864ace500e945a261b782131fe710388ec90a8446f2ae
Instruction Fuzzy Hash: 88F081365515207BC7212F669D0DDDBBE6CDBCAB52F04803AFA48B2291DA3916018AED

Uniqueness

Uniqueness Score: -1.00%

Function 00407BED Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00407C07

Part of subcall function 0040CA9F: __FF_MSGBANNER.LIBCMT ref: 0040CAB8
Part of subcall function 0040CA9F: __NMSG_WRITE.LIBCMT ref: 0040CABF
Part of subcall function 0040CA9F: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0040C469,00000000,00000001,00000000,?,0040E792,00000018,00419398,0000000C,0040E822), ref: 0040CAE4

std::exception::exception.LIBCMT ref: 00407C3C
std::exception::exception.LIBCMT ref: 00407C56
__CxxThrowException@8.LIBCMT ref: 00407C67

Strings

t_A, xrefs: 00407C35
l_A, xrefs: 00407C1F

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: l_A$t_A
API String ID: 615853336-157416012
Opcode ID: cc54d203c67dbeb22d690e521a74d423c97d8722b0cd321c0dfac2208916969a
Instruction ID: 4074200384b5878bf9638d32b00ec7341b6813f7ed76491f3cc48ce8c81626fe
Opcode Fuzzy Hash: cc54d203c67dbeb22d690e521a74d423c97d8722b0cd321c0dfac2208916969a
Instruction Fuzzy Hash: 4AF0D631D88305AADB04EB65DC42ADE77B56B41718B10407FE500B61D2DBBCAE818A4E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF0A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004192C8,00000008,0040B012,00000000,00000000,?,0040771A,?,00000000), ref: 0040AF1B
__lock.LIBCMT ref: 0040AF4F

Part of subcall function 0040E807: __mtinitlocknum.LIBCMT ref: 0040E81D
Part of subcall function 0040E807: __amsg_exit.LIBCMT ref: 0040E829
Part of subcall function 0040E807: EnterCriticalSection.KERNEL32(00000000,00000000,?,0040AF54,0000000D), ref: 0040E831

InterlockedIncrement.KERNEL32(?), ref: 0040AF5C
__lock.LIBCMT ref: 0040AF70
___addlocaleref.LIBCMT ref: 0040AF8E

Strings

KERNEL32.DLL, xrefs: 0040AF16

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: b95e8310471a0d7af0ae3488fbc118d04b24ff27f898de3904f7e751e23ef46f
Instruction ID: 0eda4398030ca1b4ec90bf296d2e7d063c9f66be767569d8fd10f411456b15f5
Opcode Fuzzy Hash: b95e8310471a0d7af0ae3488fbc118d04b24ff27f898de3904f7e751e23ef46f
Instruction Fuzzy Hash: A2018871440700EFD710AF66D805789FBE0AF40325F20C96FE496676E1CBB8A544CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411EA3 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00411EC4

Part of subcall function 0040B037: __getptd_noexit.LIBCMT ref: 0040B03A
Part of subcall function 0040B037: __amsg_exit.LIBCMT ref: 0040B047

__getptd.LIBCMT ref: 00411ED5
__getptd.LIBCMT ref: 00411EE3

Strings

RCC, xrefs: 00411EAF
csm, xrefs: 00411EBD
MOC, xrefs: 00411EB6

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: ac9acaba592351257c347e96db837c98b3d5d857367d5297a52c3b61fa2e2073
Instruction ID: ad5198425dcd16ba3a0c1d170fbc9a99a4fbbb51b7f70dae00af40d0ef6b080d
Opcode Fuzzy Hash: ac9acaba592351257c347e96db837c98b3d5d857367d5297a52c3b61fa2e2073
Instruction Fuzzy Hash: E7E01B702003045EC71497E5C049BA636A4EF48718F5500B7D91CC7372D73CDC948A4E

Uniqueness

Uniqueness Score: -1.00%

Function 00430B20 Relevance: 9.3, APIs: 6, Instructions: 262COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00430C21
__FindPESection.LIBCMT ref: 00430C3B

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 18aa4dcde5ed86294210cc9b00757967397666e754d52aa27773797f2fe3308b
Instruction ID: b7f34a7f5440cba2b05c2b3b31467a9d1aa777794c2103d39275d7fe2a6ff009
Opcode Fuzzy Hash: 18aa4dcde5ed86294210cc9b00757967397666e754d52aa27773797f2fe3308b
Instruction Fuzzy Hash: 0C91E471A002099BCB14CF59E8A176EB3B1EB8D714F16A73ED815973A0D739EC01CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00412150 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00412178

Part of subcall function 00411C90: __getptd.LIBCMT ref: 00411C9E
Part of subcall function 00411C90: __getptd.LIBCMT ref: 00411CAC

__getptd.LIBCMT ref: 00412182

Part of subcall function 0040B037: __getptd_noexit.LIBCMT ref: 0040B03A
Part of subcall function 0040B037: __amsg_exit.LIBCMT ref: 0040B047

__getptd.LIBCMT ref: 00412190
__getptd.LIBCMT ref: 0041219E
__getptd.LIBCMT ref: 004121A9
_CallCatchBlock2.LIBCMT ref: 004121CF

Part of subcall function 00411D35: __CallSettingFrame@12.LIBCMT ref: 00411D81

Part of subcall function 00412276: __getptd.LIBCMT ref: 00412285
Part of subcall function 00412276: __getptd.LIBCMT ref: 00412293

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: fac1956645845d2aab68c52f96cf8e8adbe87428b721bfe6ecc864a0291af5dc
Instruction ID: 6c4b70974c1ffbca79b9e6e4c9d4c70a0e1cf305bb07dff78cf821ec722c29e2
Opcode Fuzzy Hash: fac1956645845d2aab68c52f96cf8e8adbe87428b721bfe6ecc864a0291af5dc
Instruction Fuzzy Hash: 9811F6B1C00309DFDB00EFA5C549AEE7BB4FF08318F50806AF814A7291DB799A519F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A68D Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040A699

Part of subcall function 0040B037: __getptd_noexit.LIBCMT ref: 0040B03A
Part of subcall function 0040B037: __amsg_exit.LIBCMT ref: 0040B047

__amsg_exit.LIBCMT ref: 0040A6B9
__lock.LIBCMT ref: 0040A6C9
InterlockedDecrement.KERNEL32(?), ref: 0040A6E6
_free.LIBCMT ref: 0040A6F9
InterlockedIncrement.KERNEL32(02B01608), ref: 0040A711

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 37e3f7d88e2f556bdc05ffef4599519bac1e7625fd073d1885724976562fed73
Instruction ID: 6971d5e3c2aac5b621cddb598357bc723a53cdb569e3354dba7bbe42c2d32aea
Opcode Fuzzy Hash: 37e3f7d88e2f556bdc05ffef4599519bac1e7625fd073d1885724976562fed73
Instruction Fuzzy Hash: A501AD32901722EBC711AB26980579A77B0AB04715F19857FE850772D0CB3DA991CBDF

Uniqueness

Uniqueness Score: -1.00%

Function 00402512 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000019,00000001,?,00000000), ref: 00402537
__snwprintf.LIBCMT ref: 0040255E
DeleteFileW.KERNEL32(?), ref: 00402572

Strings

%s\%s.lnk, xrefs: 0040254D
\ExpressFiles, xrefs: 00402541

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: DeleteFileFolderPathSpecial__snwprintf
String ID: %s\%s.lnk$\ExpressFiles
API String ID: 3203081110-912599680
Opcode ID: 279e66bef23bed2c131930385371ae3957df252c151da798df29f9097843aa09
Instruction ID: d8160b51ce278e8b573f38284f18188846947325d4ae94ff0bca02206846ef0d
Opcode Fuzzy Hash: 279e66bef23bed2c131930385371ae3957df252c151da798df29f9097843aa09
Instruction Fuzzy Hash: 3001C4F2E0121C7AD710EB608C89EDB77AC9B08704F5440B7B605A31C1E6B99B888A69

Uniqueness

Uniqueness Score: -1.00%

Function 004124FD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00412510

Part of subcall function 0041246B: ___BuildCatchObjectHelper.LIBCMT ref: 004124A1

_UnwindNestedFrames.LIBCMT ref: 00412527
___FrameUnwindToState.LIBCMT ref: 00412535

Strings

csm, xrefs: 004124FF
csm, xrefs: 0041250C, 00412521, 00412534, 00412552, 00412562

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: f58864dd28486eacc90c28f0235ace34f10543c09823e2271696a671f01b4110
Instruction ID: efed86584197d68df392576cf218f9e364a751352dc458e4b88a786fa1960dbb
Opcode Fuzzy Hash: f58864dd28486eacc90c28f0235ace34f10543c09823e2271696a671f01b4110
Instruction Fuzzy Hash: DF014B7100010ABBDF12AF51CD95EEB3F6AFF08348F004016BD1854261D77ADAB1DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0042C45A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042C466

Part of subcall function 0042B66F: __getptd_noexit.LIBCMT ref: 0042B672
Part of subcall function 0042B66F: __amsg_exit.LIBCMT ref: 0042B67F

__getptd.LIBCMT ref: 0042C47D
__amsg_exit.LIBCMT ref: 0042C48B
__lock.LIBCMT ref: 0042C49B

Strings

WC, xrefs: 0042C4A8

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: WC
API String ID: 3521780317-4263399205
Opcode ID: 2fb8b0759eb99ea1a2c17ce6ff3653293dbba73d715f943043e0e0373a118853
Instruction ID: e73fcd89f32cb9bcf6c2630ad75ba8f9ee955d7973016b4d769f5e7ce728a33a
Opcode Fuzzy Hash: 2fb8b0759eb99ea1a2c17ce6ff3653293dbba73d715f943043e0e0373a118853
Instruction Fuzzy Hash: F1F09032B007309AD720FB65B852B6E73A0AF00724FD4465FA444972D2CB7C6901DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401A80 Relevance: 7.6, APIs: 5, Instructions: 96memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00418034,00000000,00000001,00418044,?), ref: 00401AC0
SysAllocString.OLEAUT32(?), ref: 00401ADB
SysFreeString.OLEAUT32(00000000), ref: 00401AF6
SysAllocString.OLEAUT32(?), ref: 00401AFB
SysFreeString.OLEAUT32(00000000), ref: 00401B37

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: String$AllocFree$CreateInstance
String ID:
API String ID: 1867060851-0
Opcode ID: d8fc38dd4b80db04442b9182fc7a30e87359efba21ac05a511a53b5363a53ebd
Instruction ID: 042ab65d192b565e9391c60aa070fa585c90e133bca2e214bd24dee86de6e88f
Opcode Fuzzy Hash: d8fc38dd4b80db04442b9182fc7a30e87359efba21ac05a511a53b5363a53ebd
Instruction Fuzzy Hash: 9F314375A00218FFCB10DBE5C888C9EBBB8EF8D71471145AAF905EB250DB75AE41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040F874 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040F882

Part of subcall function 0040CA9F: __FF_MSGBANNER.LIBCMT ref: 0040CAB8
Part of subcall function 0040CA9F: __NMSG_WRITE.LIBCMT ref: 0040CABF
Part of subcall function 0040CA9F: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0040C469,00000000,00000001,00000000,?,0040E792,00000018,00419398,0000000C,0040E822), ref: 0040CAE4

_free.LIBCMT ref: 0040F895

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: f1c698d943b60e1a01b7fb5ece37420387bac0d3d6533b4d33d8f44523ba3be3
Instruction ID: 1007cce6ced3367a689d4325fc8478d8be88f8a5dcacee1b890f5e9a067d7ad8
Opcode Fuzzy Hash: f1c698d943b60e1a01b7fb5ece37420387bac0d3d6533b4d33d8f44523ba3be3
Instruction Fuzzy Hash: 5C11BF33504215FACF317F75AC0569A3B94AF843A4B20C53BF908B66E1DB3C8C44969D

Uniqueness

Uniqueness Score: -1.00%

Function 0042BCEE Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042BCFA

Part of subcall function 0042B66F: __getptd_noexit.LIBCMT ref: 0042B672
Part of subcall function 0042B66F: __amsg_exit.LIBCMT ref: 0042B67F

__amsg_exit.LIBCMT ref: 0042BD1A
__lock.LIBCMT ref: 0042BD2A
InterlockedDecrement.KERNEL32(?), ref: 0042BD47
InterlockedIncrement.KERNEL32(02921608), ref: 0042BD72

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 2f7acb012b993c7823a334751a51ca8ca2a9730d4eb58a4d413eb6bf6e87fcd5
Instruction ID: eaa4c4c19f1c49c9ef8c2465360922452589263ce0e8834dbe8ce725df6ce1f4
Opcode Fuzzy Hash: 2f7acb012b993c7823a334751a51ca8ca2a9730d4eb58a4d413eb6bf6e87fcd5
Instruction Fuzzy Hash: A401A131F01A359BDB21AB25B44A79E77A0EF04711FD4111BE800673A1CB3C6941CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE0E Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040AE1A

Part of subcall function 0040B037: __getptd_noexit.LIBCMT ref: 0040B03A
Part of subcall function 0040B037: __amsg_exit.LIBCMT ref: 0040B047

__getptd.LIBCMT ref: 0040AE31
__amsg_exit.LIBCMT ref: 0040AE3F
__lock.LIBCMT ref: 0040AE4F
__updatetlocinfoEx_nolock.LIBCMT ref: 0040AE63

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b0fd1c1240593f422da0f5b28273b644d7123647a41d3ee9d3015b79e4b7528e
Instruction ID: 424285a83d9546143265bdbdc22f4b29bc8671e2fdc3f1256984bbbe06ae4149
Opcode Fuzzy Hash: b0fd1c1240593f422da0f5b28273b644d7123647a41d3ee9d3015b79e4b7528e
Instruction Fuzzy Hash: 13F06D33940310DBD621BB66984AB4A3690AF00729F20827FF415766D2CB7C59518A9E

Uniqueness

Uniqueness Score: -1.00%

Function 004032CF Relevance: 6.3, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004032DC
LeaveCriticalSection.KERNEL32(?), ref: 004032E9
LeaveCriticalSection.KERNEL32(?), ref: 00403333

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 6e5eb49f077cd20f1b82ff2ff0886e574cbdb812f3da21859e1f2eeadf4dcb1f
Instruction ID: d365970a083996fae6e0d921307bbfe83d62e2b099e5b71f45186992904f1c63
Opcode Fuzzy Hash: 6e5eb49f077cd20f1b82ff2ff0886e574cbdb812f3da21859e1f2eeadf4dcb1f
Instruction Fuzzy Hash: 0C011775600602EFC711CF59C98596AFBF9EF887623208479E996A3250EB34EE019B18

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC5D Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040EC91
__isleadbyte_l.LIBCMT ref: 0040ECC4
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 0040ECF5
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 0040ED63

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a61a06b1782ba220943d48ab2f3a940656767fe8c701612f1cba7b037531efb9
Instruction ID: c3d9b9972b721db3156ebc635dc6c36b122a72e72c22a10a8b28f571f0cfce3e
Opcode Fuzzy Hash: a61a06b1782ba220943d48ab2f3a940656767fe8c701612f1cba7b037531efb9
Instruction Fuzzy Hash: AF31F331A04246EFEB20CF65C984ABA7BB5EF00310F1849BEE461AB2D1D335DD61DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00424BE0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 00424C02

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __wcstoui64
String ID:
API String ID: 3882282163-0
Opcode ID: 48a9d02a2a255a56e310ec030c2647d3611f476ce6f4ed9a71b4a49d4e63c871
Instruction ID: 63cf5923bd6d8ef4116eb5826b35e6478a2e61ef5b3fc16d38349cf8837eb262
Opcode Fuzzy Hash: 48a9d02a2a255a56e310ec030c2647d3611f476ce6f4ed9a71b4a49d4e63c871
Instruction Fuzzy Hash: 1F01F5727056712BFB74463EBC4AF6B2AD4CBC5730F500276F509CA3DCD6A8C8818219

Uniqueness

Uniqueness Score: -1.00%

Function 00424B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__wcstoui64.LIBCMT ref: 00424B5C

Strings

#, xrefs: 00424B4E

Memory Dump Source

Source File: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __wcstoui64
String ID: #
API String ID: 3882282163-1885708031
Opcode ID: eb7aa83ba5c3124ead1835b4fa6fa7da76206446a146ae3038961ff377352247
Instruction ID: 468054b4e726eabdcc46a198d71a2cbdefb55da6187b9aff75bbb4fd320c834e
Opcode Fuzzy Hash: eb7aa83ba5c3124ead1835b4fa6fa7da76206446a146ae3038961ff377352247
Instruction Fuzzy Hash: 4311E3767002145FEB148A39EC81BA7779DEBC9324F448566F80DCB385E676EC508250

Uniqueness

Uniqueness Score: -1.00%

Function 0064188E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42threadCOMMON

Download Yara Rule

APIs

Thread32Next.KERNEL32 ref: 006418C2

Strings

LoadStringA, xrefs: 006418D7
4, xrefs: 00641895

Memory Dump Source

Source File: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: NextThread32
String ID: 4$LoadStringA
API String ID: 1159766829-504894296
Opcode ID: 946a94c4654a0e0b7c4c44976c00a5e3d2a71a208f68bb5685a5bbde897e4bfc
Instruction ID: 102119b48a9b1fc2e875bf96d5421f5e033de199a7086512a1440ad18668bda2
Opcode Fuzzy Hash: 946a94c4654a0e0b7c4c44976c00a5e3d2a71a208f68bb5685a5bbde897e4bfc
Instruction Fuzzy Hash: A501247180C394DBC711EB29C8854AEBFD1AEA9358F408B4EB9D467242C33A8525C76B

Uniqueness

Uniqueness Score: -1.00%

Function 00412276 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00411CE3: __getptd.LIBCMT ref: 00411CE9
Part of subcall function 00411CE3: __getptd.LIBCMT ref: 00411CF9

__getptd.LIBCMT ref: 00412285

Part of subcall function 0040B037: __getptd_noexit.LIBCMT ref: 0040B03A
Part of subcall function 0040B037: __amsg_exit.LIBCMT ref: 0040B047

__getptd.LIBCMT ref: 00412293

Strings

csm, xrefs: 004122A1

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 33ea2d12ab7dc44aea22babadc710a3016c4c562faffb84bd6d9781517db58c0
Instruction ID: 683f82ba9f5097aa5b3d5a58c68e0e1af530cf830ac5d278b4fcbe3391924061
Opcode Fuzzy Hash: 33ea2d12ab7dc44aea22babadc710a3016c4c562faffb84bd6d9781517db58c0
Instruction Fuzzy Hash: 07018F349002008BCF349F61CA44AEEB7B4BF00314F54046FE440D6791EB7889E1DBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00403635 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00403657

Strings

LJu, xrefs: 00403657
open, xrefs: 00403650

Memory Dump Source

Source File: 00000000.00000002.497460012.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.497439983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497516449.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497536976.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497555314.000000000041F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497569556.0000000000420000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497626413.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497638746.0000000000432000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497648108.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.497657400.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498696061.000000000083A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498701332.000000000083B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498709695.000000000083C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498715684.000000000083D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498721815.000000000083F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498741268.0000000000848000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498747688.0000000000849000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498759236.000000000084A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498771591.0000000000855000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498782650.0000000000857000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498791418.0000000000859000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498807246.0000000000863000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498825505.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.498840310.000000000087B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PR.jbxd

Similarity

API ID: ExecuteShell
String ID: open$LJu
API String ID: 587946157-2137115434
Opcode ID: ff93cf5a5f8a3cb8ed78bb3713a611243565e5d2c441a9d071bd69586460c9e3
Instruction ID: 6402367d08045e7231259dd9f7946bd533ae551f9e8a49ab8281ea4c466a65d9
Opcode Fuzzy Hash: ff93cf5a5f8a3cb8ed78bb3713a611243565e5d2c441a9d071bd69586460c9e3
Instruction Fuzzy Hash: 09E09A31340B006AE630CE65CC81FA37BE86B10B41F048829B65A9A7C1C6A4F648C728

Uniqueness

Uniqueness Score: -1.00%